CVE-2026-25275: FILS Authentication Frame DOS Vulnerability

CVE-2026-25275 Overview

CVE-2026-25275 is a transient denial-of-service (DoS) vulnerability affecting Qualcomm components that process Fast Initial Link Setup (FILS) authentication frames. The flaw is triggered when the affected code parses authentication frames containing invalid FILS information element header lengths. An attacker within wireless range can send a crafted frame that causes the receiving component to enter a transient DoS state, disrupting availability. The issue is classified under [CWE-126] Buffer Over-read. Qualcomm disclosed the vulnerability in its September 2026 security bulletin.

Critical Impact
Remote, unauthenticated attackers can disrupt wireless service availability on affected Qualcomm-based devices by sending malformed FILS authentication frames.

Affected Products

Qualcomm chipset firmware processing 802.11ai FILS authentication frames
Devices integrating vulnerable Qualcomm wireless components (see vendor bulletin for specific SKUs)
Downstream OEM device firmware bundling the affected Qualcomm software

Discovery Timeline

2026-09-17 - CVE-2026-25275 published to NVD
2026-09-17 - Last updated in NVD database
September 2026 - Disclosed in the Qualcomm September 2026 Security Bulletin

Technical Details for CVE-2026-25275

Vulnerability Analysis

The vulnerability resides in the parser that handles authentication frames using the Fast Initial Link Setup (FILS) extension defined in IEEE 802.11ai. FILS frames carry information elements (IEs) with length fields that must match the declared size of the encapsulated data. The affected Qualcomm code fails to validate the length field of the FILS IE header before dereferencing subsequent bytes. When a crafted frame declares a length that exceeds the actual payload, the parser reads past the allocated buffer boundary. This triggers a transient denial-of-service condition in the wireless subsystem, classified as buffer over-read under [CWE-126].

Root Cause

The root cause is missing bounds validation on the FILS information element header length field prior to buffer access. The parser trusts attacker-controlled length values without cross-checking them against the actual frame size or the remaining buffer capacity. This design gap allows out-of-bounds reads that destabilize the wireless driver or firmware.

Attack Vector

Exploitation requires an attacker to transmit a malformed 802.11 authentication frame containing an invalid FILS IE header length to a vulnerable device. No authentication or user interaction is needed. The attacker must be within wireless radio range of the target. Because FILS authentication frames are processed early in the association flow, the target does not need to be connected to any particular network for the vulnerable code path to execute.

No verified public proof-of-concept code is available for this vulnerability. Refer to the Qualcomm September 2026 Security Bulletin for vendor technical details.

Detection Methods for CVE-2026-25275

Indicators of Compromise

Unexpected wireless subsystem restarts, driver crashes, or Wi-Fi connectivity loss on Qualcomm-based devices
Repeated 802.11 authentication frames from unknown source MAC addresses observed on wireless sensors
Kernel or firmware logs referencing FILS IE parsing failures or buffer over-read faults

Detection Strategies

Deploy wireless intrusion detection (WIDS) sensors capable of decoding 802.11 management frames and flagging malformed FILS information elements
Correlate device-side crash telemetry with nearby anomalous authentication frame activity
Monitor mobile device management (MDM) and endpoint agents for repeated Wi-Fi stack restart events across a fleet

Monitoring Recommendations

Aggregate wireless driver and firmware crash logs into a centralized data lake for pattern analysis
Alert on clusters of authentication frame anomalies originating from the same source MAC or physical location
Track patch compliance status for the September 2026 Qualcomm security bulletin across managed devices

How to Mitigate CVE-2026-25275

Immediate Actions Required

Apply the vendor and OEM firmware updates referenced in the September 2026 Qualcomm security bulletin as soon as they are available for your device platform
Inventory all Qualcomm-based endpoints, mobile devices, and IoT hardware to identify vulnerable components
Prioritize patch deployment for devices operating in untrusted or high-density wireless environments

Patch Information

Qualcomm addressed CVE-2026-25275 as part of its September 2026 Security Bulletin. OEMs and carriers must integrate the fix into device firmware images before end users receive protection. Consult the Qualcomm September 2026 Security Bulletin for the definitive list of affected chipsets and patched software versions.

Workarounds

Disable FILS-based fast authentication on managed access points where the feature is not required
Restrict device use to trusted wireless networks and avoid high-risk public Wi-Fi environments until patches are applied
Segment IoT and mobile fleets on isolated wireless networks to limit exposure to hostile radio-frequency neighbors

bash

# Example: query MDM inventory for unpatched Qualcomm firmware builds
# (Adjust identifiers to match your device management platform)
mdm-cli devices list --filter "chipset=qualcomm" \
  --fields "hostname,os_version,firmware_version,patch_level" \
  --where "patch_level < 2026-09-01"