CVE-2026-21367 Overview
CVE-2026-21367 is an Out-of-Bounds Read vulnerability (CWE-126) affecting a broad range of Qualcomm chipsets and firmware. The vulnerability allows a transient Denial of Service (DoS) condition when processing nonstandard FILS (Fast Initial Link Setup) Discovery Frames that contain out-of-range action sizes during initial Wi-Fi scans. This flaw exists in the wireless network frame parsing logic and can be exploited remotely over the network without requiring authentication or user interaction.
Critical Impact
Remote attackers can trigger transient denial of service conditions on vulnerable Qualcomm-powered devices by sending specially crafted FILS Discovery Frames during the Wi-Fi scanning phase, potentially disrupting wireless connectivity across mobile devices, networking equipment, and IoT platforms.
Affected Products
- Qualcomm FastConnect 6200/6700/6900/7800 Firmware
- Qualcomm Snapdragon 6/7/8 Gen Mobile Platforms
- Qualcomm Networking Pro 400/600/800/1200/1610 Platforms
- Qualcomm IPQ5010/5028/6000/6010/6018/8076/8078/9574 Series
- Qualcomm WCN3950/3988/6450/6650/6755/7860/7861/7880/7881 Series
- Qualcomm QCN5022/5024/5052/5122/5124/5152/5154/5164/6023/6024/6122/6132/6224/6274/9000/9011/9012/9022/9024/9070/9100/9274 Series
- Qualcomm Immersive Home 214/216/316/318 Platform Firmware
- Qualcomm Snapdragon X72/X75 5G Modem-RF System Firmware
Discovery Timeline
- April 6, 2026 - CVE-2026-21367 published to NVD
- April 8, 2026 - Last updated in NVD database
Technical Details for CVE-2026-21367
Vulnerability Analysis
The vulnerability resides in the Wi-Fi firmware's handling of FILS (Fast Initial Link Setup) Discovery Frames, specifically during the initial network scanning process. FILS is a IEEE 802.11ai standard designed to reduce connection time by enabling faster authentication during roaming scenarios. When the affected firmware receives a FILS Discovery Frame containing an action field with an out-of-range size value, the parsing logic fails to properly validate the boundary conditions before reading the frame data.
This results in an out-of-bounds read operation (CWE-126) where the firmware attempts to access memory beyond the allocated buffer boundaries. While this vulnerability does not lead to code execution or data exfiltration, it causes the affected Wi-Fi subsystem to enter a transient fault state, resulting in temporary service disruption. The vulnerability is particularly concerning because it can be triggered remotely over the air without requiring any prior authentication or user interaction, and the attack can occur during the passive or active Wi-Fi scanning phases that devices perform continuously.
Root Cause
The root cause is improper input validation in the FILS Discovery Frame parsing routine. The firmware does not adequately verify that the action size field within incoming FILS Discovery Frames falls within expected boundaries before using this value to calculate buffer offsets or read operations. This missing boundary check allows malformed frames with excessively large or negative action size values to trigger memory access violations.
Attack Vector
An attacker positioned within wireless range of a vulnerable device can craft and transmit malicious FILS Discovery Frames containing out-of-range action size values. The attack requires no authentication and does not depend on the target being connected to any specific network—the vulnerability triggers during the scanning phase when devices are discovering available networks.
The attack scenario involves:
- Attacker establishes a rogue access point or uses packet injection capabilities
- Crafted FILS Discovery Frames with malformed action size fields are broadcast
- Vulnerable devices performing Wi-Fi scans receive and attempt to parse these frames
- The out-of-bounds read causes a transient DoS condition in the Wi-Fi subsystem
Due to the transient nature of this DoS, affected devices typically recover after the offending frame processing completes, but sustained attacks could cause repeated service disruptions.
Detection Methods for CVE-2026-21367
Indicators of Compromise
- Unexplained Wi-Fi connectivity drops or frequent disconnections correlating with nearby rogue wireless activity
- Increased crash reports or watchdog resets in the Wi-Fi firmware or driver subsystem
- Anomalous FILS Discovery Frames observed in wireless traffic captures with unusually large action field sizes
- System logs showing repeated Wi-Fi interface resets or firmware recovery events
Detection Strategies
- Deploy wireless intrusion detection systems (WIDS) configured to identify malformed 802.11ai FILS frames with invalid action sizes
- Monitor system logs on affected devices for patterns indicating Wi-Fi subsystem faults or recovery events
- Implement network traffic analysis to detect unusual volumes of FILS Discovery Frame activity from single sources
- Utilize endpoint detection and response (EDR) solutions to correlate Wi-Fi stability issues with potential attack patterns
Monitoring Recommendations
- Enable verbose logging on Wi-Fi subsystems where available to capture frame processing errors
- Configure alerting for repeated Wi-Fi interface reset events within short time windows
- Monitor for rogue access points broadcasting malformed management frames in enterprise environments
- Implement wireless spectrum monitoring in sensitive facilities to detect potential attack activity
How to Mitigate CVE-2026-21367
Immediate Actions Required
- Review the Qualcomm April 2026 Security Bulletin and identify all affected devices in your environment
- Prioritize firmware updates for devices in high-risk or publicly accessible locations
- Contact device manufacturers (OEMs) for availability of updated firmware incorporating Qualcomm's patches
- Consider network segmentation to limit exposure of vulnerable devices until patches can be applied
Patch Information
Qualcomm has addressed this vulnerability in their April 2026 Security Bulletin. Device manufacturers (OEMs) are responsible for integrating these fixes into their firmware update packages. Organizations should monitor for firmware updates from their specific device vendors (such as Samsung, Google, OnePlus, Xiaomi, etc. for mobile devices, and respective networking equipment vendors for routers and access points).
For detailed patch information, consult the Qualcomm April 2026 Security Bulletin.
Workarounds
- In enterprise environments, deploy WIDS/WIPS solutions capable of filtering or alerting on malformed FILS Discovery Frames
- Where supported, disable FILS (802.11ai fast roaming) features on access points if not operationally required
- Implement physical security measures in sensitive areas to limit potential attacker proximity for over-the-air exploitation
- For critical infrastructure, consider using wired connectivity as a temporary alternative until firmware updates are available
# Example: Check device firmware version on Linux-based systems with Qualcomm Wi-Fi
# Consult your device documentation for specific commands
cat /sys/firmware/devicetree/base/model
dmesg | grep -i "ath\|qca\|wcn\|wlan" | head -20
# Review vendor release notes for patched firmware versions
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
