CVE-2025-21436: Use After Free in DSP Service
Memory corruption may occur while initiating two IOCTL calls simultaneously to create processes from two different threads.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/vendor/qcom/opensource/dsp-kernelto a version that resolves this vulnerability.Fixed in SoCVersion:2025-04-05
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21436?
CVE-2025-21436 is classified as a high-severity vulnerability due to the potential for memory corruption when initiating simultaneous IOCTL calls.
How do I fix CVE-2025-21436?
To fix CVE-2025-21436, apply the latest software patch provided by Qualcomm for affected firmware versions.
Which devices are impacted by CVE-2025-21436?
CVE-2025-21436 affects various Qualcomm firmware platforms, including Fastconnect 7800, Qmp1000, and Snapdragon models.
Is CVE-2025-21436 a remote exploit?
CVE-2025-21436 requires local access as it involves initiating IOCTL calls from different threads.
What are the potential impacts of CVE-2025-21436?
Exploitation of CVE-2025-21436 could lead to system instability and unpredictable behavior due to memory corruption.