CVE-2025-27037: Qualcomm Fastconnect Use After Free Flaw

CVE-2025-27037 Overview

CVE-2025-27037 is a memory corruption vulnerability in the Qualcomm camera kernel driver. The flaw occurs while processing the config_dev IOCTL when the driver drops its reference to CPU buffers, resulting in a use-after-free condition [CWE-416]. A local attacker with low privileges can trigger the flaw through a crafted IOCTL request to the camera device. Successful exploitation compromises confidentiality, integrity, and availability of the affected system. The vulnerability affects a broad set of Qualcomm chipsets, including FastConnect, Snapdragon, and QCA product families used in mobile, automotive, and IoT platforms.

Critical Impact
Local, low-privileged code can corrupt kernel memory through the camera driver config_dev IOCTL, enabling potential kernel-level code execution and full device compromise.

Affected Products

Qualcomm Snapdragon 8 Gen 1, Snapdragon 865/865+/870 5G Mobile Platforms, Snapdragon XR2 5G, Snapdragon X55 5G Modem-RF System
Qualcomm FastConnect 6800/6900/7800; QCA6391, QCA6426, QCA6436, QCA6574AU, QCA6696, QCN9074
Qualcomm SA6145P/SA6150P/SA6155P/SA8145P/SA8150P/SA8155P/SA8195P/SA8295P, QAM8295P, SXR2130, SW5100/SW5100P, WCD9380, WCN3660B/3680B/3980/3988, WSA8810/8815/8830/8835

Discovery Timeline

2025-09-24 - CVE CVE-2025-27037 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27037

Vulnerability Analysis

The vulnerability resides in the Qualcomm camera kernel driver's handling of the config_dev IOCTL command. When the driver releases its reference to CPU-side buffers during IOCTL processing, it fails to properly synchronize buffer lifetime with concurrent or subsequent operations. This mismanaged reference counting produces a use-after-free condition in kernel memory. Because the affected code path executes in kernel context, memory corruption here translates directly into privileged execution primitives.

Exploitation requires local access and a valid handle to the camera device node, which is typically reachable by any process granted camera permissions. Once the buffer is freed but still referenced, an attacker can reclaim the memory with attacker-controlled contents. Subsequent driver operations then dereference stale pointers or metadata pointing into the reclaimed allocation.

Root Cause

The root cause is improper lifetime management of CPU buffer references inside the config_dev IOCTL handler. The driver drops its reference without ensuring that no other kernel path retains a dangling pointer to the same allocation, violating standard reference-counting invariants and producing the [CWE-416] Use-After-Free condition.

Attack Vector

An attacker executes code locally on the device with limited privileges and opens the camera driver's IOCTL interface. The attacker issues a sequence of config_dev IOCTL calls designed to force the driver to release its CPU buffer reference while another operation still holds a stale pointer. The attacker then races to reallocate the freed memory with controlled data, causing subsequent kernel access to operate on attacker-shaped structures. This yields kernel memory corruption suitable for privilege escalation to root or SELinux-bypassing execution.

// No verified public proof-of-concept is available.
// See the Qualcomm September 2025 Security Bulletin for technical details:
// https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2025-bulletin.html

Detection Methods for CVE-2025-27037

Indicators of Compromise

Unexpected kernel panics, oops messages, or KASAN use-after-free reports referencing the camera driver (cam_, camera, or vendor-specific symbols) in dmesg or logcat -b kernel.
Non-camera or unprivileged processes issuing high volumes of ioctl() calls against /dev/v4l-subdev*, /dev/video*, or Qualcomm camera device nodes.
Unexplained SELinux denials or privilege transitions following camera IOCTL activity.

Detection Strategies

Instrument endpoint telemetry to record ioctl() syscalls against camera device nodes, correlating process UID, binary path, and IOCTL command codes.
Deploy KASAN-enabled kernels in QA and fleet-sample builds to surface use-after-free conditions before they are weaponized in production.
Hunt for anomalous camera-driver access originating from processes without a legitimate media-capture role.

Monitoring Recommendations

Aggregate kernel crash reports and Android tombstones centrally, alerting on repeated camera-subsystem faults across devices.
Monitor for processes escalating to root shortly after issuing camera IOCTLs, which is a strong indicator of successful kernel exploitation.
Track patch level (SPL) and firmware version compliance across the mobile and IoT fleet to identify unpatched devices.

How to Mitigate CVE-2025-27037

Immediate Actions Required

Apply the Qualcomm firmware and kernel updates from the September 2025 security bulletin as they are delivered by OEMs and carriers.
Inventory all Qualcomm-based devices in scope, prioritizing high-value mobile endpoints, automotive units, and XR/IoT devices for patching.
Restrict camera permissions to trusted applications only through MDM policy on managed devices.

Patch Information

Qualcomm published fixes in the Qualcomm September 2025 Security Bulletin. OEM downstream availability depends on the device vendor. Confirm devices report an Android Security Patch Level (SPL) that includes the September 2025 Qualcomm-closed-source component fixes.

Workarounds

Where patching is delayed, restrict which applications can access the camera hardware through platform-level permission controls and MDM configuration profiles.
Disable or remove untrusted third-party applications that request camera or media-capture permissions on affected devices.
Enforce device attestation and block enrollment of devices below the September 2025 SPL from accessing sensitive corporate resources.

bash

# Verify Android Security Patch Level on affected devices
adb shell getprop ro.build.version.security_patch

# List installed apps holding CAMERA permission for review
adb shell pm list packages -g | while read pkg; do
  pkg=${pkg#package:}
  adb shell dumpsys package "$pkg" | grep -q android.permission.CAMERA \
    && echo "CAMERA granted: $pkg"
done