CVE-2025-21473: Qualcomm Fastconnect 6900 Use After Free

CVE-2025-21473 Overview

CVE-2025-21473 is a memory corruption vulnerability in Qualcomm firmware components affecting the Virtual Camera Data Mover (CDM) subsystem. The flaw occurs when the Virtual CDM writes to hardware registers, allowing a local, low-privileged attacker to corrupt kernel memory. Qualcomm disclosed the issue in its August 2025 security bulletin. The vulnerability is classified under [CWE-367: Time-of-Check Time-of-Use (TOCTOU) Race Condition], indicating a race between register validation and register write operations.

Critical Impact
Successful exploitation can corrupt memory in a privileged firmware context, leading to loss of confidentiality, integrity, and availability on affected Qualcomm platforms including Snapdragon 8 Gen 1 and FastConnect chipsets.

Affected Products

Qualcomm Snapdragon 8 Gen 1 Mobile Platform (and firmware)
Qualcomm FastConnect 6900 and FastConnect 7800 (and firmware)
Qualcomm WCD9380, WSA8830, and WSA8835 audio codecs (and firmware)

Discovery Timeline

2025-08-06 - CVE-2025-21473 published to NVD as part of the Qualcomm August 2025 security bulletin
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-21473

Vulnerability Analysis

The vulnerability resides in the Virtual Camera Data Mover (CDM) code path used by Qualcomm firmware to program hardware registers. The CDM is a DMA-based command engine that streams register writes to camera and multimedia IP blocks. When the Virtual CDM processes register write requests, a race condition between validation and execution allows the underlying data or register target to be modified after checks complete. This mismatch results in memory corruption within a privileged firmware context.

Because exploitation requires local access and low privileges, an attacker typically needs a foothold on the device through a malicious application or compromised process that can interact with the camera subsystem. The high attack complexity reflects the timing precision required to win the race window.

Root Cause

The root cause is a Time-of-Check Time-of-Use (TOCTOU) flaw [CWE-367]. Firmware validates register targets or payload data at one point in time, then uses those values later without ensuring they remain unchanged. A concurrent thread or DMA operation can alter the referenced memory between the check and the use, causing the CDM to write attacker-influenced values to sensitive registers.

Attack Vector

An attacker with local code execution on an affected device triggers repeated Virtual CDM register-write operations while concurrently modifying the shared buffers or descriptors that the CDM consumes. Winning the race allows corruption of firmware memory or manipulation of register writes to hardware IP blocks. This can escalate privileges, destabilize the system, or expose sensitive data processed by the camera pipeline.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Qualcomm Security Bulletin August 2025 for vendor-provided technical details.

Detection Methods for CVE-2025-21473

Indicators of Compromise

Unexpected kernel or firmware crashes referencing the camera, CDM, or DMA subsystems in device logs.
Anomalous camera HAL or media server process behavior, including repeated restarts or abnormal IOCTL patterns.
Untrusted applications with camera permissions that repeatedly invoke camera initialization or register-programming paths.

Detection Strategies

Monitor mobile device management (MDM) telemetry for devices running pre-August 2025 Qualcomm firmware patch levels on affected chipsets.
Inspect logcat and kernel ring buffer entries for CDM-related faults, use-after-free signatures, or SMMU translation errors tied to the camera stack.
Correlate application install events with subsequent camera subsystem instability to identify potentially malicious apps abusing the CDM path.

Monitoring Recommendations

Enforce firmware patch-level compliance checks in enterprise mobility management platforms and quarantine devices below the August 2025 patch level.
Track applications that request CAMERA permission alongside native code execution capabilities, and review their behavior in a sandbox.
Aggregate device crash and reboot metrics centrally to surface exploitation attempts that fail before achieving stable code execution.

How to Mitigate CVE-2025-21473

Immediate Actions Required

Apply the Qualcomm August 2025 security patch through the device OEM as soon as it is available for the affected platform.
Restrict installation of untrusted applications, especially those requesting camera or media permissions, on devices that cannot be immediately updated.
Inventory fleet devices to identify Snapdragon 8 Gen 1, FastConnect 6900/7800, WCD9380, WSA8830, and WSA8835 components requiring remediation.

Patch Information

Qualcomm published fixes in the Qualcomm Security Bulletin August 2025. Fixes are distributed to device OEMs, who integrate them into vendor firmware updates. End users must apply the corresponding OEM update to receive the patch on their devices.

Workarounds

No vendor-supplied workaround eliminates the vulnerability; patching is required.
Limit exposure by disabling or restricting third-party camera applications on high-risk devices until the OEM update is deployed.
Enforce application allow-listing and privilege separation through enterprise mobility management to reduce local attack surface.

bash

# Example: query Android device firmware patch level to identify unpatched hosts
adb shell getprop ro.build.version.security_patch
adb shell getprop ro.vendor.build.security_patch