CVE-2025-21446: Qualcomm Fastconnect 6900 DOS Vulnerability

CVE-2025-21446 Overview

CVE-2025-21446 is a transient denial-of-service vulnerability in Qualcomm WLAN firmware. The flaw occurs when the WLAN driver processes vendor-specific information elements while parsing a frame for BSS Transition Management (BTM) requests. An out-of-bounds read condition ([CWE-125], [CWE-126]) is triggered during element parsing, causing the affected component to crash.

The vulnerability affects hundreds of Qualcomm chipsets, including Snapdragon mobile SoCs, FastConnect Wi-Fi modules, IPQ access point platforms, and automotive Snapdragon Auto modems. Attackers within wireless range can transmit a malformed 802.11 management frame to disrupt connectivity on the target device.

Critical Impact
A network-adjacent attacker can transmit a malformed WLAN management frame to crash the wireless stack on Qualcomm-powered phones, laptops, automotive platforms, and access points without authentication or user interaction.

Affected Products

Qualcomm FastConnect 6700, 6800, 6900, and 7800 Wi-Fi/Bluetooth subsystems
Snapdragon 8 Gen 1/2/3, Snapdragon 888, 865, 870, and 778G mobile platforms
IPQ networking platforms (IPQ5xxx, IPQ6xxx, IPQ8xxx, IPQ9xxx) and Snapdragon Auto 5G Modem-RF

Discovery Timeline

2025-07-08 - CVE CVE-2025-21446 published to NVD
2025-08-11 - Last updated in NVD database

Technical Details for CVE-2025-21446

Vulnerability Analysis

The defect resides in the WLAN frame parser inside Qualcomm proprietary firmware. When the driver receives a frame related to an 802.11v BSS Transition Management (BTM) request, it iterates through information elements (IEs) embedded in the frame body. Vendor-specific IEs carry an organization identifier followed by vendor-defined payload data.

The parser fails to validate that the declared element length stays within the bounds of the received frame buffer. Processing a crafted vendor-specific IE causes the firmware to read past the end of the allocated buffer. This out-of-bounds read corrupts parser state or accesses unmapped memory, triggering a transient denial of service that disconnects the WLAN interface until reinitialization.

Root Cause

The root cause is improper validation of length fields ([CWE-126] Buffer Over-read, [CWE-125] Out-of-bounds Read) within vendor-specific information elements during BTM frame parsing. The parser trusts attacker-controlled length values and accesses memory beyond the legitimate element boundary inside the WLAN driver's receive path.

Attack Vector

Exploitation requires wireless proximity to the target device. An attacker associated with the same network, or one operating a rogue access point that the victim connects to, transmits an 802.11 management frame containing a malformed vendor-specific IE. No authentication or user interaction is required. The result is a transient crash of the WLAN subsystem, dropping connectivity for the user and disrupting any service relying on the wireless link, including automotive telematics or industrial IoT communications.

The vulnerability does not provide read access to memory contents or enable code execution. Impact is limited to availability of the wireless interface.

Detection Methods for CVE-2025-21446

Indicators of Compromise

Repeated, unexplained WLAN disconnections or driver restarts on Qualcomm-powered devices during roaming events
Kernel or firmware logs showing crashes in WLAN parsing routines correlated with reception of 802.11v BTM frames
Access point logs recording clients dropping immediately after receiving management frames with anomalous vendor IE lengths

Detection Strategies

Monitor wireless intrusion detection systems (WIDS) for 802.11 management frames containing vendor-specific information elements with length fields exceeding the remaining frame body
Correlate device crash telemetry with proximity-based wireless events to surface adjacent-attacker patterns
Inspect mobile device management (MDM) crash reports for repeated WLAN firmware faults across a deployed fleet

Monitoring Recommendations

Enable verbose WLAN driver logging on a representative subset of endpoints to capture parser fault stacks
Deploy WIDS sensors in coverage areas where vulnerable Qualcomm-based devices operate, particularly in automotive fleets and industrial environments
Track Qualcomm Product Security advisories and OEM downstream bulletins for newly disclosed parser-related CVEs in the same code path

How to Mitigate CVE-2025-21446

Immediate Actions Required

Inventory devices using Qualcomm FastConnect, Snapdragon mobile, Snapdragon Auto, and IPQ platforms to determine exposure scope
Apply OEM firmware updates incorporating the Qualcomm July 2025 security patch as soon as vendors publish them
Restrict device association to trusted SSIDs and enable enterprise-grade authentication (WPA3-Enterprise) to reduce exposure to rogue access points

Patch Information

Qualcomm published the fix in its July 2025 Security Bulletin. Refer to the Qualcomm July 2025 Security Bulletin for the list of patched firmware images. OEM device manufacturers must integrate the patched firmware into their downstream releases. End users receive the fix through device firmware or operating system updates from their hardware vendor.

Workarounds

Disable WLAN on affected devices in environments where wired connectivity is feasible until patches are applied
Configure enterprise WLAN infrastructure to suppress 802.11v BTM features for vulnerable client populations where supported
Segment guest and untrusted wireless networks from production traffic to limit attacker proximity to critical Qualcomm-based endpoints

bash

# Verify Qualcomm WLAN firmware version on Android (requires adb)
adb shell getprop | grep -i "wlan\|qcom"
adb shell dumpsys wifi | grep -i "driver\|firmware"

# Linux/OpenWrt: query IPQ-based AP firmware
cat /sys/module/ath11k/version 2>/dev/null
logread | grep -i "ath11k\|qca\|wlan" | tail -50