CVE-2025-21459: Qualcomm AR8035 Firmware DOS Vulnerability

CVE-2025-21459 Overview

CVE-2025-21459 is a transient denial-of-service (DoS) vulnerability affecting a broad range of Qualcomm chipsets and firmware. The flaw resides in the WLAN firmware code path that parses the per-STA profile contained within a Multi-Link (ML) Information Element (IE), a structure introduced with Wi-Fi 7 (802.11be) for multi-link operation. An attacker within wireless range can transmit a malformed ML IE to trigger an out-of-bounds read condition, classified under [CWE-125] and [CWE-126], which causes the affected device's WLAN subsystem to crash. Qualcomm published a fix in its May 2025 Security Bulletin.

Critical Impact

Remote, unauthenticated attackers can disrupt wireless connectivity on Snapdragon-powered phones, automotive systems, IoT devices, and access points by transmitting crafted 802.11 frames containing malformed Multi-Link Information Elements.

Affected Products

• Qualcomm FastConnect 6700, 6900, and 7800 Wi-Fi/Bluetooth subsystems
• Snapdragon 8 Gen 2, Gen 3, and 8+ Gen 2 Mobile Platforms; Snapdragon X72/X75 5G Modem-RF
• Qualcomm QCA, QCN, WCN, WCD, and WSA series firmware (QCA6391, QCN9274, WCN7860, WCN6755, and many others)

Discovery Timeline

• 2025-05-06 - CVE-2025-21459 published to NVD
• 2025-08-11 - Last updated in NVD database

Technical Details for CVE-2025-21459

Vulnerability Analysis

The vulnerability is an out-of-bounds read that occurs while the Qualcomm WLAN firmware parses the per-STA profile sub-element nested inside a Multi-Link Information Element. Multi-Link Operation (MLO) is a Wi-Fi 7 feature that allows a single logical station to advertise and operate over multiple radio links simultaneously. Each affiliated radio is described by a per-STA profile carried in the ML IE. The parser reads length and offset fields supplied by the attacker without sufficiently validating that the described profile remains within the bounds of the containing element.

When the parser dereferences attacker-controlled offsets, it reads past the end of the IE buffer. The resulting fault terminates the WLAN firmware thread and tears down the wireless interface. Because no authentication or association is required, the attacker only needs to transmit a single crafted management or beacon frame within radio range. The vulnerability does not allow code execution, but it disrupts availability of any affected radio.

Root Cause

The root cause is missing or incomplete bounds checking on length fields within the per-STA profile structure. The firmware trusts attacker-supplied length values rather than validating them against the remaining IE buffer. This pattern aligns with both [CWE-125] (Out-of-Bounds Read) and [CWE-126] (Buffer Over-Read).

Attack Vector

The attack vector is adjacent wireless network access. An attacker transmits a malformed 802.11 frame containing a crafted ML IE — for example, an unprotected beacon, probe response, or association frame — to any device with an affected Qualcomm radio in scanning or connected state. The target's WLAN firmware parses the IE and crashes, dropping connectivity until the radio is reinitialized.

No verified exploitation code is publicly available. See the Qualcomm May 2025 Security Bulletin for vendor-confirmed technical details.

Detection Methods for CVE-2025-21459

Indicators of Compromise

• Repeated WLAN firmware crash, restart, or subsystem reset (SSR) events in kernel logs on Qualcomm-based devices
• Unexpected disconnects from Wi-Fi networks correlating with the presence of unknown 802.11be-capable transmitters nearby
• Beacon or probe-response frames containing malformed or oversized Multi-Link Information Elements (Element ID 255, Extension ID 107)

Detection Strategies

• Inspect over-the-air captures for ML IEs whose declared per-STA profile lengths exceed the containing element length
• Correlate device-side WLAN watchdog or wlan_ssr events with timing of nearby unrecognized 802.11 transmitters
• Deploy wireless intrusion detection sensors that decode 802.11be management frames and flag malformed IE structures

Monitoring Recommendations

• Centralize mobile device management (MDM) telemetry to track firmware patch levels across Qualcomm-powered fleets
• Forward kernel and WLAN subsystem logs to a central log platform to identify clusters of radio crashes
• Monitor wireless airspace in sensitive locations for repeated transmission of malformed Multi-Link frames

How to Mitigate CVE-2025-21459

Immediate Actions Required

• Apply the Qualcomm May 2025 security patches as soon as device manufacturers (OEMs) release them through their normal update channels
• Inventory all endpoints, vehicles, IoT, and infrastructure devices using affected Qualcomm chipsets and prioritize patch rollout
• Where patching is delayed, restrict use of Wi-Fi in untrusted environments and prefer wired or cellular connectivity for critical assets

Patch Information

Qualcomm released fixes for affected components in the Qualcomm May 2025 Security Bulletin. Patches are delivered to end users through OEM firmware updates for phones, automotive platforms, access points, and IoT devices. Verify that the device firmware build date or security patch level reflects the May 2025 bulletin or later.

Workarounds

• Disable Wi-Fi 7 / Multi-Link Operation on affected client devices and access points if the configuration option is exposed
• Operate sensitive devices on protected wireless networks with management frame protection (802.11w / PMF) required
• Reduce Wi-Fi attack surface in high-risk locations by limiting auto-join to trusted SSIDs and disabling background scanning where feasible

# Example: verify Android security patch level reflects May 2025 bulletin
adb shell getprop ro.build.version.security_patch
# Expected output: 2025-05-01 or later