CVE-2025-47397 Overview
CVE-2025-47397 is a memory corruption vulnerability affecting a wide range of Qualcomm chipsets and firmware components. The flaw occurs when the GPU driver initiates memory mapping using scatter-gather lists and fails to check return values from Input-Output Memory Management Unit (IOMMU) mapping operations. The condition is classified as [CWE-401] (Missing Release of Memory after Effective Lifetime), and Qualcomm has addressed it in the February 2026 security bulletin. The vulnerability requires local access and low privileges, and successful exploitation can compromise confidentiality, integrity, and availability on affected devices.
Critical Impact
A local, low-privileged attacker can trigger memory corruption in the GPU driver path, potentially leading to kernel-level instability, privilege escalation, or denial of service on Snapdragon-based mobile, automotive, IoT, and embedded platforms.
Affected Products
- Qualcomm Snapdragon mobile platforms (Snapdragon 4/6/7/8 Gen series, Snapdragon 8 Elite, Snapdragon 8+ Gen 1/2, Snapdragon AR1 Gen 1)
- Qualcomm automotive and robotics platforms (SA8155P, SA8255P, SA8295P, SA8770P, QCS8550, Robotics RB5, Flight RB5 5G)
- Qualcomm FastConnect, QCA, WCN, WCD, WSA, and IQ-series firmware components used in IoT, audio, and connectivity solutions
Discovery Timeline
- 2026-02-02 - CVE-2025-47397 published to NVD
- February 2026 - Qualcomm releases security patch via the February 2026 security bulletin
- 2026-02-11 - Last updated in NVD database
Technical Details for CVE-2025-47397
Vulnerability Analysis
The vulnerability resides in the Qualcomm GPU driver code path responsible for mapping GPU buffers into device-accessible memory using scatter-gather (SG) lists. Scatter-gather lists are used to describe physically non-contiguous memory regions that the GPU must access through the IOMMU. During the mapping setup, the driver does not validate the result of IOMMU mapping calls. When a mapping fails, execution continues as if it had succeeded, leaving the driver operating on partial or invalid mappings.
Because GPU drivers run in kernel context and interact with privileged IOMMU hardware, the corrupted state can be reached from a local user-space process holding standard GPU access privileges, which is the default for many graphics-enabled applications on Snapdragon devices.
Root Cause
The root cause is missing error handling around IOMMU mapping APIs invoked while constructing scatter-gather mappings for GPU buffers. The driver releases or reuses resources based on the assumption that mapping succeeded, resulting in inconsistent kernel data structures, dangling references, and memory not properly released along its effective lifetime ([CWE-401]). This inconsistent state forms the basis for memory corruption.
Attack Vector
Exploitation requires local access to the device and the ability to interact with the GPU driver from user space, such as through standard graphics or compute APIs that allocate and map GPU buffers. An attacker crafts allocation patterns that force IOMMU mapping failures, then triggers subsequent operations that act on the corrupted mapping state. No user interaction is required beyond running the malicious application, and the attack does not cross authentication boundaries because most GPU device nodes are accessible to ordinary application processes.
No verified public proof-of-concept code is available. See the Qualcomm Security Bulletin February 2026 for vendor-supplied technical details and component-level patch references.
Detection Methods for CVE-2025-47397
Indicators of Compromise
- Repeated kernel log entries referencing IOMMU mapping failures, GPU page faults, or scatter-gather mapping errors on Snapdragon devices
- Unexpected GPU driver crashes, kernel panics, or device reboots tied to specific user-space processes invoking GPU buffer allocations
- Anomalous memory allocation patterns from non-graphics applications repeatedly exercising GPU buffer mapping interfaces
Detection Strategies
- Monitor kernel ring buffer (dmesg) and Android logcat output for IOMMU fault traces and KGSL/Adreno driver warnings on affected chipsets
- Correlate process telemetry with GPU subsystem errors to identify low-privileged processes triggering abnormal mapping failure rates
- Track firmware and OS patch level against the February 2026 Qualcomm security bulletin to flag unpatched devices in inventory
Monitoring Recommendations
- Centralize mobile and IoT device telemetry, including kernel logs and crash reports, in a security data lake for longitudinal analysis
- Alert on bursts of GPU driver faults originating from a single user identifier or application package across managed device fleets
- Validate that vendor security patch levels reported by managed devices match or exceed the February 2026 Qualcomm bulletin baseline
How to Mitigate CVE-2025-47397
Immediate Actions Required
- Identify all devices and embedded systems using affected Qualcomm chipsets, including Snapdragon mobile, automotive, IoT, and FastConnect components
- Apply the firmware and driver updates referenced in the Qualcomm February 2026 security bulletin as soon as OEM updates are available
- Restrict installation of untrusted third-party applications on affected devices until patches are deployed
Patch Information
Qualcomm has released fixes as part of the February 2026 security bulletin. Device-level patches must be delivered by Original Equipment Manufacturers (OEMs) through firmware and Android security updates. Refer to the Qualcomm Security Bulletin February 2026 for the complete list of fixed components and corresponding patch identifiers.
Workarounds
- Limit untrusted local code execution on affected devices by enforcing application allow-listing and Mobile Device Management (MDM) policies
- Disable or restrict access to non-essential GPU compute workloads on automotive, robotics, and IoT platforms where feasible until firmware is updated
- Monitor for and quarantine devices that exhibit repeated GPU driver crashes or IOMMU fault patterns pending vendor patch deployment
# Example: query Android device for Qualcomm security patch level
adb shell getprop ro.vendor.build.security_patch
adb shell getprop ro.build.version.security_patch
# Example: capture kernel log evidence of IOMMU/GPU mapping failures
adb shell dmesg | grep -Ei 'iommu|kgsl|adreno|sg_table|map'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
