CVE-2025-21424
📋 TL;DR
This CVE describes a use-after-free vulnerability (CWE-416) in Qualcomm NPU driver APIs that can be triggered through concurrent calls, leading to memory corruption. It affects devices with Qualcomm chipsets that use vulnerable NPU drivers. Successful exploitation could allow attackers to execute arbitrary code or cause denial of service.
💻 Affected Systems
- Qualcomm chipsets with NPU (Neural Processing Unit) capabilities
📦 What is this software?
215 Firmware by Qualcomm
Snapdragon 7c\+ Gen 3 Compute Firmware by Qualcomm
View all CVEs affecting Snapdragon 7c\+ Gen 3 Compute Firmware →
Snapdragon Auto 5g Modem Rf Firmware by Qualcomm
View all CVEs affecting Snapdragon Auto 5g Modem Rf Firmware →
Snapdragon Auto 5g Modem Rf Gen 2 Firmware by Qualcomm
View all CVEs affecting Snapdragon Auto 5g Modem Rf Gen 2 Firmware →
Snapdragon W5\+ Gen 1 Wearable Firmware by Qualcomm
View all CVEs affecting Snapdragon W5\+ Gen 1 Wearable Firmware →
Snapdragon Xr2\+ Gen 1 Firmware by Qualcomm
Video Collaboration Vc1 Platform Firmware by Qualcomm
View all CVEs affecting Video Collaboration Vc1 Platform Firmware →
Video Collaboration Vc3 Platform Firmware by Qualcomm
View all CVEs affecting Video Collaboration Vc3 Platform Firmware →
Video Collaboration Vc5 Platform Firmware by Qualcomm
View all CVEs affecting Video Collaboration Vc5 Platform Firmware →
Vision Intelligence 400 Firmware by Qualcomm
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with kernel privileges leading to complete system compromise, data theft, or persistent backdoor installation.
Likely Case
Local privilege escalation from user to kernel space, allowing attackers to bypass security controls and gain elevated access.
If Mitigated
Denial of service through system crashes or instability if exploitation attempts fail or are partially successful.
🎯 Exploit Status
Requires concurrent API calls to trigger the use-after-free condition; exploitation likely requires local access and knowledge of driver internals.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Qualcomm March 2025 security bulletin for specific patched versions
Vendor Advisory: https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2025-bulletin.html
Restart Required: Yes
Instructions:
1. Check Qualcomm advisory for affected chipset models. 2. Obtain updated firmware/driver from device manufacturer. 3. Apply patch following manufacturer's instructions. 4. Reboot device to load patched driver.
🔧 Temporary Workarounds
Disable NPU functionality
linuxTemporarily disable Neural Processing Unit features if not required
echo 0 > /sys/class/npu/enable
modprobe -r qcom_npu_driver
Restrict NPU driver access
linuxUse SELinux/AppArmor to restrict which processes can access NPU driver
setenforce 1
Configure appropriate SELinux policies for NPU device nodes
🧯 If You Can't Patch
- Implement strict application sandboxing to prevent untrusted apps from accessing NPU APIs
- Monitor system logs for NPU driver crashes or unusual memory access patterns
🔍 How to Verify
Check if Vulnerable:
Check chipset model and driver version: 'cat /proc/cpuinfo | grep -i qualcomm' and 'lsmod | grep npu'Check Version:
dmesg | grep -i npu && cat /sys/module/qcom_npu_driver/versionVerify Fix Applied:
Verify driver version matches patched version from Qualcomm advisory and test concurrent NPU API calls📡 Detection & Monitoring
Log Indicators:
- Kernel panic messages related to NPU driver
- Use-after-free warnings in kernel logs
- Multiple concurrent NPU API calls from single process
Network Indicators:
- None - this is a local driver vulnerability
SIEM Query:
source="kernel" AND ("NPU" OR "npu_driver") AND ("panic" OR "use-after-free" OR "corruption")