CVE-2025-21485: Qualcomm Fastconnect Use After Free Flaw

CVE-2025-21485 Overview

CVE-2025-21485 is a memory corruption vulnerability in Qualcomm's FastRPC driver. The flaw occurs while processing INIT and multimode invoke IOCTL calls. Qualcomm published the issue in its June 2025 security bulletin, and the vulnerability affects a broad set of Snapdragon, FastConnect, and audio codec firmware components used across mobile, wearable, and extended reality platforms.

The underlying weakness is a Time-of-Check Time-of-Use (TOCTOU) race condition ([CWE-367]). A local, authenticated attacker with low privileges can trigger memory corruption through crafted IOCTL sequences to the FastRPC device node. Successful exploitation impacts confidentiality, integrity, and availability of the affected system.

Critical Impact
Local attackers can corrupt kernel memory through the FastRPC driver, enabling privilege escalation, arbitrary code execution in kernel context, or device compromise on affected Qualcomm platforms.

Affected Products

Qualcomm Snapdragon 8 Gen 3 Mobile Platform and SM8735 / SM8750 / SM8750P firmware
Qualcomm FastConnect 6900 and FastConnect 7800 firmware
Qualcomm Snapdragon W5+ Gen 1 Wearable Platform, SW5100/SW5100P, SXR2230P/SXR2250P/SXR2330P, WCD93xx audio codecs, WCN77xx/WCN78xx connectivity chips, and WSA88xx smart speaker amplifiers

Discovery Timeline

2025-06-03 - CVE-2025-21485 published to NVD
June 2025 - Qualcomm publishes fix in the Qualcomm Security Bulletin June 2025
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-21485

Vulnerability Analysis

FastRPC is Qualcomm's remote procedure call framework that enables the application processor to offload work to auxiliary DSPs, including the compute DSP (cDSP) and audio DSP (aDSP). Userspace clients interact with the FastRPC kernel driver through IOCTL calls to initialize sessions, marshal arguments, and dispatch invocations.

The vulnerability arises during processing of the INIT IOCTL and the multimode invoke IOCTL paths. According to Qualcomm, the driver contains a TOCTOU race condition in these code paths. User-controlled fields are validated once and then re-read or re-used after the check, allowing a concurrent thread to alter the underlying memory or descriptor state between validation and use.

Root Cause

The root cause is a race condition classified as [CWE-367] (Time-of-Check Time-of-Use). Fields supplied through IOCTL argument structures — such as buffer descriptors, invocation handles, or session parameters — are not consistently captured or locked after validation. A concurrent thread sharing the same file descriptor can modify these values, so the driver operates on attacker-mutated data during the sensitive use phase, corrupting kernel memory structures.

Attack Vector

The attack vector is local. An attacker needs code execution on the device with permission to open the FastRPC device node (for example, /dev/adsprpc-smd or the cDSP equivalent). On Android, this access is typically available to unprivileged applications and system services that leverage DSP-accelerated features. The attacker issues carefully sequenced INIT and multimode invoke IOCTL calls from multiple threads to win the race and corrupt kernel state, enabling privilege escalation to kernel context. No user interaction is required.

Because no verified public proof-of-concept is available, refer to the Qualcomm Security Bulletin June 2025 for authoritative technical details on the affected IOCTL paths and remediation.

Detection Methods for CVE-2025-21485

Indicators of Compromise

Unexpected kernel oops, panics, or KASAN reports referencing FastRPC driver symbols (for example, fastrpc_internal_invoke, fastrpc_init_create, or adsprpc functions)
Unprivileged applications opening /dev/adsprpc-smd, /dev/cdsprpc-smd, or /dev/adsprpc-smd-secure with high-frequency IOCTL sequences
SELinux denials or audit events involving the adsprpc_device or cdsprpc_device label from non-authorized domains

Detection Strategies

Monitor kernel logs (dmesg, logcat -b kernel) for crashes, use-after-free traces, or slab corruption warnings tied to FastRPC/adsprpc modules
Baseline expected FastRPC consumers on managed devices and alert on unknown processes issuing DSP IOCTLs
Correlate rapid multi-threaded IOCTL bursts against the FastRPC file descriptors with subsequent privilege changes or process crashes

Monitoring Recommendations

Enroll mobile and embedded devices in an MDM that reports Android/vendor security patch level and can flag devices below the June 2025 patch level
Ingest device and kernel telemetry into a centralized data lake to hunt for anomalous FastRPC usage patterns and DSP-related kernel faults
Track vendor patch adoption metrics across the fleet, prioritizing high-value handsets, wearables, and XR devices built on affected Snapdragon platforms

How to Mitigate CVE-2025-21485

Immediate Actions Required

Apply the June 2025 Qualcomm firmware updates to all affected Snapdragon, FastConnect, WCN, WCD, WSA, SW, and SXR components as delivered by the device OEM
Ensure Android devices are updated to a security patch level of 2025-06-05 or later, which incorporates the Qualcomm closed-source component fixes
Inventory affected chipsets across mobile handsets, wearables, XR headsets, and IoT devices, and prioritize remediation for devices exposed to untrusted applications

Patch Information

Qualcomm has released fixes for CVE-2025-21485 as part of the Qualcomm Security Bulletin June 2025. Patches are distributed to OEMs and integrated into device-specific firmware updates. Consult your device manufacturer's advisory for the exact build that incorporates the fix.

Workarounds

Restrict installation of untrusted or sideloaded applications on affected devices until firmware updates are applied
Where feasible, use SELinux/MAC policies to limit which processes can open FastRPC device nodes to trusted system components only
Disable or avoid workloads that require DSP offload via FastRPC on high-risk devices until patched firmware is deployed