CVE-2025-47315: Qualcomm Qam8255p Use-After-Free Flaw

CVE-2025-47315 Overview

CVE-2025-47315 is a memory corruption vulnerability in Qualcomm automotive and connectivity firmware. The flaw occurs when the hypervisor handles repeated memory unmap requests originating from a guest virtual machine (VM). A malicious guest can trigger a use-after-free condition [CWE-416] in the host, corrupting memory in a higher-privileged context. The issue affects a broad range of Qualcomm Snapdragon Auto and QCA connectivity platforms, including the SA8255P, SA8295P, SA8775P, and multiple QCA6xxx Wi-Fi/Bluetooth chipsets. Qualcomm addressed the vulnerability in its September 2025 security bulletin.

Critical Impact
A local attacker with low privileges inside a guest VM can corrupt host hypervisor memory, leading to code execution, data tampering, or denial of service on the host system.

Affected Products

Qualcomm Snapdragon Auto platforms: SA7255P, SA7775P, SA8255P, SA8295P, SA8540P, SA8620P, SA8650P, SA8770P, SA8775P, SA9000P
Qualcomm QAM automotive modems: QAM8255P, QAM8295P, QAM8620P, QAM8650P, QAM8775P, QAMSRV1H, QAMSRV1M
Qualcomm QCA connectivity chipsets and Snapdragon SRV1 platforms: QCA6574AU, QCA6595, QCA6595AU, QCA6688AQ, QCA6696, QCA6698AQ, QCA6797AQ, SRV1H, SRV1L, SRV1M

Discovery Timeline

2025-09-24 - CVE-2025-47315 published to the National Vulnerability Database (NVD)
September 2025 - Qualcomm publishes fix in the Qualcomm September 2025 Security Bulletin
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-47315

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] in Qualcomm hypervisor code that manages guest VM memory mappings. When a guest VM issues repeated unmap requests for the same memory region, the host does not properly synchronize the lifecycle of the underlying tracking structures. Subsequent operations then dereference stale pointers, corrupting host memory. Because Qualcomm automotive platforms rely on virtualization to isolate safety-critical, infotainment, and connectivity domains, corruption in the host breaks the guest-to-host trust boundary that the platform depends on.

Root Cause

The root cause is improper object lifetime management in the memory unmap handler. The handler releases or frees metadata associated with an already-unmapped region without ensuring that concurrent or duplicate unmap paths cannot reference the same structure. Repeated unmap requests exercise this race and reuse path, producing a dangling reference in the hypervisor. The condition is deterministic enough to be triggered from an unprivileged workload running inside a guest VM.

Attack Vector

An attacker requires local, low-privileged access inside a guest VM on an affected Qualcomm platform. Network access is not required, and no user interaction is needed. The attacker issues crafted, repeated memory unmap hypercalls against the host to trigger the use-after-free. Successful exploitation can corrupt hypervisor memory to escalate privilege from the guest into the host, tamper with peer guest domains, or crash the platform. On automotive targets, this can affect safety-relevant subsystems sharing the SoC.

No public proof-of-concept exploit is available at time of writing, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-47315

Indicators of Compromise

Unexpected hypervisor or TrustZone panics, watchdog resets, or kernel logs referencing memory unmap or IOMMU faults on Qualcomm automotive platforms.
Guest VM processes issuing abnormally high volumes of memory unmap hypercalls or ioctl sequences targeting shared-memory interfaces.
Post-crash firmware crash dumps showing dereferences of freed hypervisor memory management structures.

Detection Strategies

Collect and centrally analyze hypervisor, bootloader, and kernel logs from affected Qualcomm-based devices to identify anomalous unmap patterns and repeated fault signatures.
Baseline normal virtualization hypercall rates per guest workload; alert on guests that deviate significantly, particularly on unmap or memory-sharing paths.
Correlate device telemetry with the affected CPE list from the September 2025 Qualcomm bulletin to prioritize fleets running unpatched firmware.

Monitoring Recommendations

Monitor firmware and OS build versions across the vehicle or device fleet and flag any endpoints still running pre-September 2025 Qualcomm firmware.
Ingest device logs and crash reports into a centralized data lake or SIEM so use-after-free driven crashes can be triaged as potential exploitation attempts, not just reliability issues.
Alert on repeated guest VM restarts or hypervisor resets on the same platform, which often precede successful memory corruption exploitation.

How to Mitigate CVE-2025-47315

Immediate Actions Required

Apply the firmware updates referenced in the Qualcomm September 2025 Security Bulletin to all affected SA, QAM, QCA, and SRV1 platforms.
Inventory all devices using the listed Qualcomm SoCs and firmware, prioritizing automotive head units, telematics control units, and connected infotainment systems.
Restrict workloads running inside guest VMs so that only trusted, signed code can issue virtualization hypercalls.

Patch Information

Qualcomm published the fix in its September 2025 security bulletin. Original equipment manufacturers (OEMs) integrate Qualcomm patches into device-specific firmware images, so operators should confirm that their OEM has shipped a corresponding update that references CVE-2025-47315. Deploy the patched firmware through the OEM's standard over-the-air (OTA) or service update channel and validate the version after installation.

Workarounds

No vendor-supplied workaround replaces the firmware update; treat patching as the required remediation.
Where patching is delayed, reduce exposure by limiting third-party or untrusted code execution inside guest VMs on affected platforms.
Enforce strict signing and attestation for any software loaded into guest domains on Qualcomm automotive SoCs until patched firmware is deployed.

bash

# Example: verify installed Qualcomm firmware build on an Android-based automotive target
# and confirm it corresponds to the September 2025 (or later) security patch level.
adb shell getprop ro.build.version.security_patch
adb shell getprop ro.vendor.build.version.security_patch
adb shell getprop ro.boot.qcom.baseband