# November 2026 Security Bulletin

## Published: 11/02/2026

This security bulletin is intended to help Qualcomm Technologies, Inc. (QTI) customers incorporate security updates in launched or upcoming devices.
                This document includes (i) a description of security issues that have been addressed in QTI’s proprietary code and (ii) links to publicly available code where security issues have been addressed.

Please reach out to
                [securitybulletin@qti.qualcomm.com](mailto:securitybulletin@qti.qualcomm.com)
                for any questions related to this bulletin.

## Table of Contents

| Announcements |
| --- |
| Acknowledgements |
| Proprietary Software Issues |
| Open Source Software Issues |
| Industry Coordination |

##  Announcements 

None

## Acknowledgements

We would like to thank these researchers for their contributions in reporting these issues to us.

| CVE-2026-65073,CVE-2026-25279,CVE-2026-25300,CVE-2026-65075,CVE-2026-66113,CVE-2026-66114 | heidada (heiheidada) |
| --- | --- |
| CVE-2026-25287 | Xue Zhang |
| CVE-2026-57548 | keto |
| CVE-2026-57549 | Brinly |
| CVE-2026-65072 | conghuiwang |
| CVE-2026-80013 | Lukas Maar |
| CVE-2026-80015 | Lukas Maar (lmaar) |

## Proprietary Software Issues

The tables below summarize security vulnerabilities that were addressed through proprietary software

This table lists high impact security vulnerabilities.
                Patches are being actively shared with OEMs, who have been notified and strongly recommended to deploy those patches on released devices as soon as possible. 
                Please contact the device manufacturer for information on the patching status of released devices.

| Public ID | Security Rating | CVSS Rating | Technology Area | Date Reported |
| --- | --- | --- | --- | --- |
| CVE-2026-25285 | Critical | Critical | HLOS | Internal |
| CVE-2026-25279 | High | High | Graphics Windows | 08/21/2025 |
| CVE-2026-25286 | High | High | HLOS | Internal |
| CVE-2026-25287 | High | High | Multi-Mode Call Processor | 01/08/2026 |
| CVE-2026-25300 | High | High | Video | 10/24/2024 |
| CVE-2026-65075 | High | High | Power Management IC | 02/21/2026 |
| CVE-2026-65076 | High | High | WLAN Firmware | Internal |
| CVE-2026-65078 | High | High | Graphics Windows | Internal |
| CVE-2026-65079 | High | High | Graphics Windows | Internal |
| CVE-2026-66115 | High | High | Graphics Windows | Internal |

### CVE-2026-25285

| CVE ID | CVE-2026-25285 |
| --- | --- |
| Title | Out-of-bounds Write in HLOS |
| Description | Memory corruption when importing a malformed RSA key with an excessively large public exponent into the Keystore. |
| Technology Area | HLOS |
| Vulnerability Type | CWE-787: Out-of-bounds Write |
| Access Vector | Local |
| Security Rating | Critical |
| CVSS Rating | Critical |
| CVSS Score | 9.3 |
| CVSS String | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| Date Reported | Internal |
| Customer Notified Date | 2026/05/04 |
| Affected Chipsets\* | Snapdragon G1 Gen 2 Gaming Platform, AR8035, Cologne, CQ7790, CQ8725S, CQ8750M, CQ8850NS, CSRA6620, CSRA6640, FastConnect 6200, FastConnect 6700, FastConnect 6800, FastConnect 6900, FastConnect 7800, FWA Gen 3 Ultra Platform, FWA Gen 5 Elite Platform, G1 Gen 1, G2 Gen 1, G3x Gen 2, IQ10 Series, IQ6 Series Platform, IQ8 Series Platform, IQ9 Series Platform, IQX5121, Kalpeni, Kobuk, LeMans\_AU\_LGIT, LeMansAU, MBM415, MBM715, Milos, Monaco\_IOT, Netrani, Orne, Palawan25, Pandeiro, Q-2390, Q-4390, QAM8255P, QAM8295P, QAM8620P, QAMSRV1H, QAMSRV1M, QCA0000, QCA6174A, QCA6391, QCA6564AU, QCA6574, QCA6574A, QCA6574AU, QCA6584AU, QCA6595, QCA6595AU, QCA6678AQ, QCA6688AQ, QCA6696, QCA6698AQ, QCA6698AU, QCA6797AQ, QCA8081, QCA8337, QCA8386, QCA8695AU, QCC2070, QCC6705, QCC710, QCF8001, QCM2290, QCM4290, QCM4325, QCM5430, QCM6125, QCM6490, QCM8838, QCN6024, QCN6224, QCN6274, QCN9011, QCN9012, QCN9024, QCS2290, QCS4290, QCS8550, QDU1000, QDU1110, QDU1210, QDX1010, QDX1011, QEP8111, QFW7114, QFW7124, QFW7224, QLN1083BD, QLN1086BD, QMP1000, QMP2001, QMX82L, QMX85L, QPA1083BD, QPA1086BD, QRU1032, Qualcomm 215 Mobile Platform, Qualcomm Dragonwing™ IQ-X, Qualcomm Dragonwing™ Q-6690, Qualcomm Dragonwing™ Q-7790, Qualcomm Dragonwing™ Q-8845, Qualcomm Dragonwing™ QCM4490, Qualcomm Dragonwing™ QRB5165, Qualcomm Dragonwing™ QRU100 Platform, Qualcomm Dragonwing™ X100 Accelerator Card, Qualcomm® Video Collaboration VC1 Platform, Qualcomm® Video Collaboration VC3 Platform, Qualcomm® Video Collaboration VC5 Platform, QXM1083, QXM1086, QXM1093, QXM1094, QXM1095, QXM1096, Robotics RB2 Platform, Robotics RB5 Platform, SA4150P, SA4155P, SA510M, SA6145P, SA6150P, SA6155P, SA7255P, SA7775P, SA8145P, SA8150P, SA8155P, SA8195P, SA8255P, SA8295P, SA8540P, SA8620P, SA8770P, SA9000P, SAR1165P, SAR1230P, SAR2130P, SC8380XP, SD 8 Gen1 5G, SD662, SD865 5G, SDR753, SDX61, SDX81, SM4850, SM4850P, SM4875, SM6225P, SM6450P, SM6475P, SM6475Q, SM6650P, SM6850, SM7325P, SM7435, SM7435P, SM7525, SM7550, SM7550P, SM7635P, SM7675, SM7675P, SM7750P, SM8475P, SM8550P, SM8635, SM8635P, SM8650Q, SM8735P, SM8750P, SM8845P, Smart Audio 400 Platform, Snapdragon 4 Gen 1 Mobile Platform, Snapdragon 4 Gen 2 Mobile Platform, Snapdragon 460 Mobile Platform, Snapdragon 480 5G Mobile Platform, Snapdragon 480+ 5G Mobile Platform, Snapdragon 6 Gen 1 Mobile Platform, Snapdragon 6 Gen 3 Mobile Platform, Snapdragon 6 Gen 4 Mobile Platform, Snapdragon 662 Mobile Platform, Snapdragon 680 4G Mobile Platform, Snapdragon 685 4G Mobile Platform, Snapdragon 690 5G Mobile Platform, Snapdragon 695 5G Mobile Platform, Snapdragon 7 Gen 1 Mobile Platform, Snapdragon 7 Gen 4 Mobile Platform, Snapdragon 7+ Gen 2 Mobile Platform, Snapdragon 778G 5G Mobile Platform, Snapdragon 778G+ 5G Mobile Platform, Snapdragon 782G Mobile Platform, Snapdragon 7c+ Gen 3 Compute, Snapdragon 7s Gen 3 Mobile Platform, Snapdragon 8 Elite, Snapdragon 8 Elite Gen 5, Snapdragon 8 Gen 1 Mobile Platform, Snapdragon 8 Gen 2 Mobile Platform, Snapdragon 8 Gen 3 Mobile Platform, Snapdragon 8 Gen 5, Snapdragon 8+ Gen 1 Mobile Platform, Snapdragon 8+ Gen 2 Mobile Platform, Snapdragon 865 5G Mobile Platform, Snapdragon 865+ 5G Mobile Platform, Snapdragon 870 5G Mobile Platform, Snapdragon 888 5G Mobile Platform, Snapdragon 888+ 5G Mobile Platform, Snapdragon 8cx Gen 3 Compute Platform, Snapdragon AR1 Gen 1 Platform, Snapdragon AR1+ Gen 1 Platform, Snapdragon Auto 5G Modem-RF Gen 2, Snapdragon C Platform, Snapdragon Ride™ Elite , Snapdragon W5+ Gen 1 Wearable Platform, Snapdragon X2 Elite, Snapdragon X32 5G Modem-RF System, Snapdragon X35 5G Modem-RF System, Snapdragon X53 5G Modem-RF System, Snapdragon X55 5G Modem-RF System, Snapdragon X62 5G Modem-RF System, Snapdragon X65 5G Modem-RF System, Snapdragon X72 5G Modem-RF System, Snapdragon X75 5G Modem-RF System, Snapdragon XR2 5G Platform, Snapdragon XR2+ Gen 1 Platform, Snapdragon® Cockpit Elite, Snapdragon® Reality Elite Platform, Snapdragon® Wear Elite platform, SRV1H, SRV1L, SRV1M, SW-only, SW5100, SW5100P, SXR2230P, SXR2250P, Themisto, WCD9326, WCD9335, WCD9340, WCD9370, WCD9371, WCD9375, WCD9378, WCD9378C, WCD9380, WCD9385, WCD9390, WCD9395, WCN3615, WCN3660B, WCN3680B, WCN3910, WCN3950, WCN3980, WCN3988, WCN6450, WCN6650, WCN6755, WCN7760, WCN7860, WCN7861, WCN7880, WCN7881, WSA8810, WSA8815, WSA8830, WSA8832, WSA8835, WSA8840, WSA8845, WSA8845H, WSA8850, WSA8850W, WSA8855C, XRV7200, XRV7205, XRV7209, XRV9209 |

### CVE-2026-25279

| CVE ID | CVE-2026-25279 |
| --- | --- |
| Title | Use After Free in Graphics Windows |
| Description | Memory Corruption when accessing deleted private allocation data after it has been freed during graphics processing. |
| Technology Area | Graphics Windows |
| Vulnerability Type | CWE-416 Use After Free |
| Access Vector | Local |
| Security Rating | High |
| CVSS Rating | High |
| CVSS Score | 7.8 |
| CVSS String | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Date Reported | 2025/08/21 |
| Customer Notified Date | 2026/05/04 |
| Affected Chipsets\* | AQT1000, Cologne, FastConnect 6200, FastConnect 6700, FastConnect 6800, FastConnect 6900, FastConnect 7800, IQX5121, QCA0000, QCA6391, QCA6420, QCA6430, QCC2070, QCC6705, QCM5430, QCM6490, Qualcomm Dragonwing™ IQ-X, Qualcomm® Video Collaboration VC3 Platform, SC8380XP, SM6250, Snapdragon 460 Mobile Platform, Snapdragon 662 Mobile Platform, Snapdragon 7c Compute Platform, Snapdragon 7c Gen 2 Compute Platform "Rennell Pro", Snapdragon 7c+ Gen 3 Compute, Snapdragon 8c Compute Platform "Poipu Lite", Snapdragon 8c Compute Platform (SC8180XP-AD) "Poipu Lite", Snapdragon 8cx Compute Platform, Snapdragon 8cx Compute Platform "Poipu Pro", Snapdragon 8cx Gen 2 5G Compute Platform, Snapdragon 8cx Gen 2 5G Compute Platform "Poipu Pro", Snapdragon 8cx Gen 3 Compute Platform, Snapdragon C Platform, Snapdragon X2 Elite, SXR2230P, SXR2250P, WCD9340, WCD9341, WCD9370, WCD9375, WCD9378C, WCD9380, WCD9385, WCN3950, WCN3988, WSA8810, WSA8815, WSA8830, WSA8832, WSA8835, WSA8840, WSA8845, WSA8845H |

### CVE-2026-25286

| CVE ID | CVE-2026-25286 |
| --- | --- |
| Title | NULL Pointer Dereference in HLOS |
| Description | Transient DOS when creating an asymmetric key with an empty attestation key and no provisioned factory attestation key. |
| Technology Area | HLOS |
| Vulnerability Type | CWE-476 NULL Pointer Dereference |
| Access Vector | Local |
| Security Rating | High |
| CVSS Rating | High |
| CVSS Score | 7.1 |
| CVSS String | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H |
| Date Reported | Internal |
| Customer Notified Date | 2026/05/04 |
| Affected Chipsets\* | Cologne, CQ7790, CQ8725S, CQ8750M, FastConnect 6200, FastConnect 6700, FastConnect 6900, FastConnect 7800, G2 Gen 1, IQ6 Series Platform, IQ8 Series Platform, IQ9 Series Platform, LeMans\_AU\_LGIT, LeMansAU, MBM415, MBM715, Monaco\_IOT, Netrani, Orne, Palawan25, Pandeiro, Q-4390, QAM8255P, QAM8295P, QAMSRV1H, QAMSRV1M, QCA6574, QCA6574A, QCA6574AU, QCA6595, QCA6595AU, QCA6678AQ, QCA6688AQ, QCA6696, QCA6698AQ, QCA6797AQ, QCA8695AU, QCM5430, QCM6490, QDU1000, QDU1110, QDU1210, QDX1010, QDX1011, QLN1083BD, QLN1086BD, QMP1000, QPA1083BD, QPA1086BD, Qualcomm Dragonwing™ IQ-X, Qualcomm Dragonwing™ Q-7790, Qualcomm Dragonwing™ QCM4490, Qualcomm Dragonwing™ X100 Accelerator Card, Qualcomm® Video Collaboration VC3 Platform, QXM1093, QXM1094, QXM1095, QXM1096, SA6145P, SA6150P, SA6155P, SA7255P, SA7775P, SA8145P, SA8150P, SA8155P, SA8195P, SA8255P, SA8295P, SA8540P, SA8620P, SA8770P, SA9000P, SM6450P, SM6475P, SM6475Q, SM7435, SM7435P, SM7635P, SM7750P, SM8735P, SM8750P, Snapdragon 4 Gen 2 Mobile Platform, Snapdragon 6 Gen 1 Mobile Platform, Snapdragon 6 Gen 3 Mobile Platform, Snapdragon 7 Gen 4 Mobile Platform, Snapdragon 8 Elite, Snapdragon® Reality Elite Platform, Snapdragon® Wear Elite platform, SRV1H, SRV1M, SW-only, Themisto, WCD9370, WCD9375, WCD9378, WCD9380, WCD9385, WCD9395, WCN3950, WCN3988, WCN6755, WCN7760, WCN7860, WCN7861, WCN7880, WCN7881, WSA8810, WSA8815, WSA8830, WSA8832, WSA8835, WSA8840, WSA8845, WSA8845H, XRV7209, XRV9209 |

### CVE-2026-25287

| CVE ID | CVE-2026-25287 |
| --- | --- |
| Title | Always-Incorrect Control Flow Implementation in Multi-Mode Call Processor |
| Description | Transient DOS when processing certain non-integrity-protected 5G registration reject messages with a specific cause value. |
| Technology Area | Multi-Mode Call Processor |
| Vulnerability Type | CWE-670 Always-Incorrect Control Flow Implementation |
| Access Vector | Remote |
| Security Rating | High |
| CVSS Rating | High |
| CVSS Score | 7.4 |
| CVSS String | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H |
| Date Reported | 2026/01/08 |
| Customer Notified Date | 2026/05/04 |
| Affected Chipsets\* | Snapdragon G1 Gen 2 Gaming Platform, AR8035, Cologne, Congo, CQ7790, CQ8725S, CQ8750M, CQ8850NS, FastConnect 6200, FastConnect 6700, FastConnect 6900, FastConnect 7800, FSM200 Platform, FSM20055, FWA Gen 3 Ultra Platform, FWA Gen 5 Elite Platform, G2 Gen 1, G3x Gen 2, Kalpeni, Kobuk, MBM415, MBM715, Milos, Netrani, Orne, Palawan25, Pandeiro, Q-4390, QCA6174A, QCA6391, QCA6564AU, QCA6574A, QCA6574AU, QCA6584AU, QCA6595AU, QCA6678AQ, QCA6688AQ, QCA6698AQ, QCA6698AU, QCA6797AQ, QCA8081, QCA8337, QCA8386, QCC710, QCF8001, QCM8838, QCN6024, QCN6224, QCN6274, QCN9011, QCN9012, QCN9024, QCS8550, QEP8111, QFW7114, QFW7124, QFW7224, QMP1000, QMP2001, QMX82L, QMX85L, Qualcomm Dragonwing™ Q-6690, Qualcomm Dragonwing™ Q-7790, Qualcomm Dragonwing™ Q-8845, Qualcomm Dragonwing™ QCM4490, Qualcomm® FastConnect™ 8800 Mobile Connectivity System, SA510M, SD 8 Gen1 5G, SDR753, SDX61, SDX71M, SDX81, SM4850, SM4850P, SM4875, SM6450P, SM6475P, SM6475Q, SM6650P, SM6850, SM7435, SM7435P, SM7525, SM7550, SM7550P, SM7635P, SM7675, SM7675P, SM7750P, SM8475P, SM8550P, SM8635, SM8635P, SM8650Q, SM8735P, SM8750P, SM8845P, SM8950P, SM8975P, Snapdragon 4 Gen 2 Mobile Platform, Snapdragon 6 Gen 1 Mobile Platform, Snapdragon 6 Gen 3 Mobile Platform, Snapdragon 6 Gen 4 Mobile Platform, Snapdragon 7 Gen 1 Mobile Platform, Snapdragon 7 Gen 4 Mobile Platform, Snapdragon 7+ Gen 2 Mobile Platform, Snapdragon 7s Gen 3 Mobile Platform, Snapdragon 8 Elite, Snapdragon 8 Elite Extreme Gen 6, Snapdragon 8 Elite Gen 5, Snapdragon 8 Elite Gen 6, Snapdragon 8 Gen 1 Mobile Platform, Snapdragon 8 Gen 2 Mobile Platform, Snapdragon 8 Gen 3 Mobile Platform, Snapdragon 8 Gen 5, Snapdragon 8+ Gen 1 Mobile Platform, Snapdragon 8+ Gen 2 Mobile Platform, Snapdragon Auto 5G Modem-RF Gen 2, Snapdragon X32 5G Modem-RF System, Snapdragon X35 5G Modem-RF System, Snapdragon X62 5G Modem-RF System, Snapdragon X65 5G Modem-RF System, Snapdragon X70 Modem-RF System, Snapdragon X72 5G Modem-RF System, Snapdragon X75 5G Modem-RF System, Snapdragon X80 5G Modem-RF System, Snapdragon® Wear Elite platform, SW-only, Themisto, WCD9340, WCD9370, WCD9371, WCD9375, WCD9378, WCD9380, WCD9385, WCD9390, WCD9395, WCN3950, WCN3988, WCN6450, WCN6650, WCN6755, WCN7760, WCN7860, WCN7861, WCN7880, WCN7881, WCN8841, WSA8810, WSA8815, WSA8830, WSA8832, WSA8835, WSA8840, WSA8845, WSA8845H, WSA8850, WSA8850W, WSA8855C |

### CVE-2026-25300

| CVE ID | CVE-2026-25300 |
| --- | --- |
| Title | Use After Free in Video |
| Description | Memory Corruption when processing stats-enable and stats-disable escape commands due to improper synchronization of global variables and concurrent access to a freed buffer. |
| Technology Area | Video |
| Vulnerability Type | CWE-416 Use After Free |
| Access Vector | Local |
| Security Rating | High |
| CVSS Rating | High |
| CVSS Score | 7.8 |
| CVSS String | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Date Reported | 2024/10/24 |
| Customer Notified Date | 2026/08/03 |
| Affected Chipsets\* | AQT1000, Cologne, FastConnect 6200, FastConnect 6700, FastConnect 6900, FastConnect 7800, IQX5121, QCA0000, Qualcomm Dragonwing™ IQ-X, SC8380XP, SM6250, Snapdragon 7c Compute Platform, Snapdragon 7c Gen 2 Compute Platform "Rennell Pro", Snapdragon 7c+ Gen 3 Compute, Snapdragon 8c Compute Platform "Poipu Lite", Snapdragon 8c Compute Platform (SC8180XP-AD) "Poipu Lite", Snapdragon 8cx Compute Platform, Snapdragon 8cx Compute Platform "Poipu Pro", Snapdragon 8cx Gen 2 5G Compute Platform, Snapdragon 8cx Gen 2 5G Compute Platform "Poipu Pro", Snapdragon X2 Elite, WCD9340, WCD9341, WCD9378C, WCD9380, WCD9385, WSA8810, WSA8815, WSA8840, WSA8845, WSA8845H |

### CVE-2026-65075

| CVE ID | CVE-2026-65075 |
| --- | --- |
| Title | Buffer Copy Without Checking Size of Input in Power Management IC |
| Description | Memory Corruption when processing oversized battery status messages. |
| Technology Area | Power Management IC |
| Vulnerability Type | CWE-120 Buffer Copy Without Checking Size of Input ('Classic Buffer Overflow') |
| Access Vector | Local |
| Security Rating | High |
| CVSS Rating | High |
| CVSS Score | 7.8 |
| CVSS String | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Date Reported | 2026/02/21 |
| Customer Notified Date | 2026/08/03 |
| Affected Chipsets\* | AQT1000, Cologne, FastConnect 6200, FastConnect 6700, FastConnect 6800, FastConnect 6900, FastConnect 7800, IQX5121, QCA0000, QCA6391, QCA6420, QCA6430, QCC2070, QCC6705, QCM5430, QCM6490, Qualcomm Dragonwing™ IQ-X, Qualcomm® Video Collaboration VC3 Platform, SC8380XP, Snapdragon 7c+ Gen 3 Compute, Snapdragon 8c Compute Platform "Poipu Lite", Snapdragon 8c Compute Platform (SC8180XP-AD) "Poipu Lite", Snapdragon 8cx Compute Platform, Snapdragon 8cx Compute Platform "Poipu Pro", Snapdragon 8cx Gen 2 5G Compute Platform, Snapdragon 8cx Gen 2 5G Compute Platform "Poipu Pro", Snapdragon 8cx Gen 3 Compute Platform, Snapdragon C Platform, WCD9340, WCD9341, WCD9370, WCD9375, WCD9380, WCD9385, WSA8810, WSA8815, WSA8830, WSA8835, WSA8840, WSA8845, WSA8845H |

### CVE-2026-65076

| CVE ID | CVE-2026-65076 |
| --- | --- |
| Title | Buffer Over-read in WLAN Firmware |
| Description | Transient DOS when processing a malformed 802.11az management frame causes the firmware to read beyond the allocated buffer. |
| Technology Area | WLAN Firmware |
| Vulnerability Type | CWE-126 Buffer Over-read |
| Access Vector | Remote |
| Security Rating | High |
| CVSS Rating | High |
| CVSS Score | 7.5 |
| CVSS String | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| Date Reported | Internal |
| Customer Notified Date | 2026/08/03 |
| Affected Chipsets\* | 5G Fixed Wireless Access Platform, AR8035, Cologne, Congo, CQ7790, CQ8725S, CQ8750M, CQ8850NS, CSR8811, F8 Platform, FastConnect 6200, FastConnect 6700, FastConnect 6900, FastConnect 7800, FiberPro A8 Elite, FWA Gen 3 Ultra Platform, FWA Gen 5 Elite Platform, G2 Gen 1, G3x Gen 2, Immersive Home 214 Platform, Immersive Home 216 Platform, Immersive Home 316 Platform, Immersive Home 318 Platform, Immersive Home 3210 Platform, Immersive Home 326 Platform, IPQ5010, IPQ5028, IPQ5300, IPQ5302, IPQ5312, IPQ5332, IPQ6000, IPQ6010, IPQ6018, IPQ8076, IPQ8078, IPQ9008, IPQ9048, IPQ9554, IPQ9570, IPQ9574, IQ10 Series, IQ8 Series Platform, IQ9 Series Platform, IQX5121, Juhu, Kobuk, LeMans\_AU\_LGIT, LeMansAU, Marina, MBM715, Milos, Monaco\_IOT, N8 Platform, Netrani, Networking Pro 1200 Platform, Networking Pro 1210 Platform, Networking Pro 1610 Platform, Networking Pro 400 Platform, Networking Pro 600 Platform, Networking Pro 610 Platform, Networking Pro 800 Platform, Networking Pro 810 Platform, NPro A8 Elite Platform, Orne, Palawan25, Pandeiro, QAM8255P, QAMSRV1H, QAMSRV1M, QCA0000, QCA4024, QCA6391, QCA6554A, QCA6564AU, QCA6574, QCA6574A, QCA6574AU, QCA6584AU, QCA6595, QCA6595AU, QCA6678AQ, QCA6688AQ, QCA6696, QCA6698AQ, QCA6777AQ, QCA6787AQ, QCA6797AQ, QCA8075, QCA8080, QCA8081, QCA8082, QCA8084, QCA8085, QCA8101, QCA8102, QCA8111, QCA8112, QCA8334, QCA8335, QCA8337, QCA8384, QCA8385, QCA8386, QCA8695AU, QCA9888, QCA9889, QCC2070, QCC2073, QCC2076, QCC710, QCE1204, QCE2204, QCE2224, QCF8000, QCF8000SFP, QCF8001, QCM5430, QCM6490, QCM8838, QCN5021, QCN5022, QCN5023, QCN5024, QCN5052, QCN5121, QCN5122, QCN5123, QCN5124, QCN5152, QCN5154, QCN5164, QCN5224, QCN5575, QCN6023, QCN6024, QCN6112, QCN6122, QCN6132, QCN6224, QCN6274, QCN6402, QCN6412, QCN6422, QCN6432, QCN6629, QCN9000, QCN9011, QCN9012, QCN9013, QCN9022, QCN9024, QCN9070, QCN9100, QCN9160, QCN9274, QCS8550, QFW7114, QFW7124, QFW7224, QLN1083BD, QLN1086BD, QMP1000, QMP2001, QMX82L, QMX85L, QPA1083BD, QPA1086BD, Qualcomm Dragonwing™ IQ-X, Qualcomm Dragonwing™ Q-6690, Qualcomm Dragonwing™ Q-7790, Qualcomm Dragonwing™ Q-8845, Qualcomm® FastConnect™ 8800 Mobile Connectivity System, Qualcomm® Video Collaboration VC3 Platform, QXM1083, QXM1086, QXM1093, QXM1094, QXM1095, QXM1096, QXM8083, QXM8086, SA7255P, SA7775P, SA8255P, SA8620P, SA8770P, SA9000P, SAR1165P, SAR1230P, SAR2130P, SC8380XP, SD865 5G, SDR753, SDX65M, SDX81, SM4875, SM6450P, SM6475P, SM6475Q, SM6650P, SM6850, SM7435, SM7435P, SM7525, SM7550, SM7550P, SM7635P, SM7675, SM7675P, SM7750P, SM8550P, SM8635, SM8635P, SM8650Q, SM8735P, SM8750P, SM8845P, SM8950P, SM8975P, Snapdragon 6 Gen 1 Mobile Platform, Snapdragon 6 Gen 3 Mobile Platform, Snapdragon 6 Gen 4 Mobile Platform, Snapdragon 7 Gen 4 Mobile Platform, Snapdragon 7s Gen 3 Mobile Platform, Snapdragon 8 Elite, Snapdragon 8 Elite Extreme Gen 6, Snapdragon 8 Elite Gen 5, Snapdragon 8 Elite Gen 6, Snapdragon 8 Gen 2 Mobile Platform, Snapdragon 8 Gen 3 Mobile Platform, Snapdragon 8 Gen 5, Snapdragon 8+ Gen 2 Mobile Platform, Snapdragon AR1 Gen 1 Platform, Snapdragon AR1+ Gen 1 Platform, Snapdragon Auto 5G Modem-RF Gen 2, Snapdragon Ride™ Elite , Snapdragon X2 Elite, Snapdragon X65 5G Modem-RF System, Snapdragon X72 5G Modem-RF System, Snapdragon X75 5G Modem-RF System, Snapdragon XR2 5G Platform, Snapdragon XR2+ Gen 1 Platform, Snapdragon® Cockpit Elite, Snapdragon® Reality Elite Platform, SRV1H, SRV1M, SW-only, SXR2230P, SXR2250P, Trestles, WCD9340, WCD9370, WCD9371, WCD9375, WCD9378, WCD9378C, WCD9380, WCD9385, WCD9390, WCD9395, WCN3988, WCN6450, WCN6650, WCN6755, WCN7760, WCN7860, WCN7861, WCN7880, WCN7881, WCN8841, WSA8810, WSA8815, WSA8830, WSA8832, WSA8835, WSA8840, WSA8845, WSA8845H, WSA8850, WSA8850W, WSA8855C, X1E80100, X1P42100, X1P44100, X1P46100, XRV7200, XRV7205, XRV7209, XRV9209 |

### CVE-2026-65078

| CVE ID | CVE-2026-65078 |
| --- | --- |
| Title | Use of Out-of-range Pointer Offset in Graphics Windows |
| Description | Memory Corruption when processing user-influenced values from a command buffer results in out-of-bounds memory access in the GPU address space. |
| Technology Area | Graphics Windows |
| Vulnerability Type | CWE-823 Use of Out-of-range Pointer Offset |
| Access Vector | Local |
| Security Rating | High |
| CVSS Rating | High |
| CVSS Score | 7.8 |
| CVSS String | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Date Reported | Internal |
| Customer Notified Date | 2026/08/03 |
| Affected Chipsets\* | AQT1000, Cologne, FastConnect 6200, FastConnect 6700, FastConnect 6800, FastConnect 6900, FastConnect 7800, IQX5121, QCA0000, QCA6391, QCA6420, QCA6430, QCC2070, QCC6705, QCM5430, QCM6490, Qualcomm Dragonwing™ IQ-X, Qualcomm® Video Collaboration VC3 Platform, SC8380XP, SM6250, Snapdragon 7c Compute Platform, Snapdragon 7c Gen 2 Compute Platform "Rennell Pro", Snapdragon 7c+ Gen 3 Compute, Snapdragon 8c Compute Platform "Poipu Lite", Snapdragon 8c Compute Platform (SC8180XP-AD) "Poipu Lite", Snapdragon 8cx Compute Platform, Snapdragon 8cx Compute Platform "Poipu Pro", Snapdragon 8cx Gen 2 5G Compute Platform, Snapdragon 8cx Gen 2 5G Compute Platform "Poipu Pro", Snapdragon 8cx Gen 3 Compute Platform, Snapdragon C Platform, Snapdragon X2 Elite, WCD9340, WCD9341, WCD9370, WCD9375, WCD9378C, WCD9380, WCD9385, WSA8810, WSA8815, WSA8830, WSA8835, WSA8840, WSA8845, WSA8845H |

### CVE-2026-65079

| CVE ID | CVE-2026-65079 |
| --- | --- |
| Title | Integer Overflow or Wraparound in Graphics Windows |
| Description | Memory Corruption when creating a graphics surface with large dimensions due to integer overflow during memory size computation. |
| Technology Area | Graphics Windows |
| Vulnerability Type | CWE-190 Integer Overflow or Wraparound |
| Access Vector | Local |
| Security Rating | High |
| CVSS Rating | High |
| CVSS Score | 7.8 |
| CVSS String | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Date Reported | Internal |
| Customer Notified Date | 2026/08/03 |
| Affected Chipsets\* | AQT1000, Cologne, FastConnect 6200, FastConnect 6700, FastConnect 6800, FastConnect 6900, FastConnect 7800, IQX5121, QCA0000, QCA6391, QCA6420, QCA6430, QCC2070, QCC6705, QCM5430, QCM6490, Qualcomm Dragonwing™ IQ-X, Qualcomm® Video Collaboration VC3 Platform, SC8380XP, SM6250, Snapdragon 7c Compute Platform, Snapdragon 7c Gen 2 Compute Platform "Rennell Pro", Snapdragon 7c+ Gen 3 Compute, Snapdragon 8c Compute Platform "Poipu Lite", Snapdragon 8c Compute Platform (SC8180XP-AD) "Poipu Lite", Snapdragon 8cx Compute Platform, Snapdragon 8cx Compute Platform "Poipu Pro", Snapdragon 8cx Gen 2 5G Compute Platform, Snapdragon 8cx Gen 2 5G Compute Platform "Poipu Pro", Snapdragon 8cx Gen 3 Compute Platform, Snapdragon C Platform, Snapdragon X2 Elite, WCD9340, WCD9341, WCD9370, WCD9375, WCD9378C, WCD9380, WCD9385, WSA8810, WSA8815, WSA8830, WSA8835, WSA8840, WSA8845, WSA8845H |

### CVE-2026-66115

| CVE ID | CVE-2026-66115 |
| --- | --- |
| Title | Buffer Copy Without Checking Size of Input in Graphics Windows |
| Description | Memory corruption when writing beyond the allocated buffer boundary due to insufficient bounds checking during DMA buffer patching operations. |
| Technology Area | Graphics Windows |
| Vulnerability Type | CWE-120 Buffer Copy Without Checking Size of Input ('Classic Buffer Overflow') |
| Access Vector | Local |
| Security Rating | High |
| CVSS Rating | High |
| CVSS Score | 7.8 |
| CVSS String | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Date Reported | Internal |
| Customer Notified Date | 2026/08/03 |
| Affected Chipsets\* | AQT1000, Cologne, FastConnect 6200, FastConnect 6700, FastConnect 6800, FastConnect 6900, FastConnect 7800, IQX5121, QCA0000, QCA6391, QCA6420, QCA6430, QCC2070, QCC6705, QCM5430, QCM6490, Qualcomm Dragonwing™ IQ-X, Qualcomm® Video Collaboration VC3 Platform, SC8380XP, SM6250, Snapdragon 7c Compute Platform, Snapdragon 7c Gen 2 Compute Platform "Rennell Pro", Snapdragon 7c+ Gen 3 Compute, Snapdragon 8c Compute Platform "Poipu Lite", Snapdragon 8c Compute Platform (SC8180XP-AD) "Poipu Lite", Snapdragon 8cx Compute Platform, Snapdragon 8cx Compute Platform "Poipu Pro", Snapdragon 8cx Gen 2 5G Compute Platform, Snapdragon 8cx Gen 2 5G Compute Platform "Poipu Pro", Snapdragon 8cx Gen 3 Compute Platform, Snapdragon C Platform, Snapdragon X2 Elite, WCD9340, WCD9341, WCD9370, WCD9375, WCD9378C, WCD9380, WCD9385, WSA8810, WSA8815, WSA8830, WSA8835, WSA8840, WSA8845, WSA8845H |

\*The list of affected chipsets may not be complete.
                For latest information, device OEMs can contact QTI directly at [www.qualcomm.com/support](https://www.qualcomm.com/support).

## Open Source Software Issues

The tables below summarize security vulnerabilities that were addressed through open source software

This table lists high impact security vulnerabilities.
                Patches are being actively shared with OEMs, who have been notified and strongly recommended to deploy those patches on released devices as soon as possible.
                Please contact the device manufacturer for information on the patching status of released devices.

| Public ID | Security Rating | CVSS Rating | Technology Area | Date Reported |
| --- | --- | --- | --- | --- |
| CVE-2026-65073 | Critical | High | WLAN Host | 04/23/2026 |
| CVE-2026-25301 | High | High | Graphics | Internal |
| CVE-2026-57548 | High | High | Graphics | 03/30/2026 |
| CVE-2026-57549 | High | High | Graphics | 03/24/2026 |
| CVE-2026-65072 | High | High | Automotive GPU | 04/17/2026 |
| CVE-2026-66113 | High | High | Display | 05/10/2026 |
| CVE-2026-66114 | High | High | Display | 05/10/2026 |

This table lists moderate security vulnerabilities. OEMs have been notified and encouraged to patch these issues.

| Public ID | Security Rating | CVSS Rating | Technology Area | Date Reported |
| --- | --- | --- | --- | --- |
| CVE-2026-80013 | Medium | Medium | Data Network Stack & Connectivity | 05/14/2026 |
| CVE-2026-80015 | Medium | Medium | Data Network Stack & Connectivity | 05/14/2026 |

### CVE-2026-65073

| CVE ID | CVE-2026-65073 |
| --- | --- |
| Title | Use After Free in WLAN Host |
| Description | Memory Corruption when processing association response frames due to accessing freed memory. |
| Technology Area | WLAN Host |
| Vulnerability Type | CWE-416 Use After Free |
| Access Vector | Remote |
| Security Rating | Critical |
| CVSS Rating | High |
| CVSS Score | 8.8 |
| CVSS String | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Date Reported | 2026/04/23 |
| Customer Notified Date | 2026/08/03 |
| Affected Chipsets\* | AR8035, Cologne, Congo, FastConnect 6700, FastConnect 6900, FastConnect 7800, MDM9250, MDM9628, MDM9640, Milos, Netrani, Orne, Pandeiro, Q-4390, QCA6174A, QCA6175A, QCA6391, QCA6564A, QCA6564AU, QCA6574, QCA6574A, QCA6574AU, QCA6584, QCA6584AU, QCA6595, QCA6595AU, QCA6777AQ, QCA6787AQ, QCA6797AQ, QCA8081, QCA8337, QCA9367, QCA9377, QCA9379, QCC2073, QCC2076, QCM2290, QCM4290, QCM4325, QCN6024, QCN9011, QCN9012, QCN9024, QCS2290, QCS4290, QEP8111, Qualcomm 215 Mobile Platform, Qualcomm Dragonwing™ QCM4490, Qualcomm® FastConnect™ 8800 Mobile Connectivity System, Qualcomm® Video Collaboration VC1 Platform, Qualcomm® Video Collaboration VC3 Platform, SA2150P, SAR1165P, SC8380XP, SD662, SD865 5G, SDM429W, SDX61, SM6225P, SM7325P, SM7435, SM8950P, SM8975P, Snapdragon 4 Gen 2 Mobile Platform, Snapdragon 429 Mobile Platform, Snapdragon 460 Mobile Platform, Snapdragon 6 Gen 1 Mobile Platform, Snapdragon 6 Gen 3 Mobile Platform, Snapdragon 6 Gen 4 Mobile Platform, Snapdragon 662 Mobile Platform, Snapdragon 680 4G Mobile Platform, Snapdragon 685 4G Mobile Platform, Snapdragon 778G 5G Mobile Platform, Snapdragon 778G+ 5G Mobile Platform, Snapdragon 782G Mobile Platform, Snapdragon 7c+ Gen 3 Compute, Snapdragon 7s Gen 3 Mobile Platform, Snapdragon 8 Elite Extreme Gen 6, Snapdragon 8 Elite Gen 5, Snapdragon 8 Elite Gen 6, Snapdragon 820 Automotive Platform, Snapdragon 820Am, Snapdragon 888 5G Mobile Platform, Snapdragon 888+ 5G Mobile Platform, Snapdragon AR1 Gen 1 Platform, Snapdragon AR1+ Gen 1 Platform, Snapdragon Auto 5G Modem-RF, Snapdragon X12 LTE Modem, Snapdragon X35 5G Modem-RF System, Snapdragon X5 LTE Modem, Snapdragon X53 5G Modem-RF System, Snapdragon X65 5G Modem-RF System, Snapdragon XR2 5G Platform, Snapdragon XR2+ Gen 1 Platform, SXR2230P, SXR2250P, WCD9326, WCD9330, WCD9335, WCD9340, WCD9370, WCD9375, WCD9378, WCD9380, WCD9385, WCD9395, WCN3615, WCN3620, WCN3660B, WCN3680B, WCN3950, WCN3980, WCN3988, WCN6755, WCN7760, WCN7860, WCN7861, WCN7880, WCN7881, WCN8841, WSA8810, WSA8815, WSA8830, WSA8832, WSA8835, WSA8840, WSA8845, WSA8845H, X1E80100 |
| Patch\*\* | <ul><li><br>                                             <a class="word-wrap" href="https://git.codelinaro.org/clo/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/-/commit/f4743c978bbea4f7e05902f7c52d181f64e805b4" target="_blank">https://git.codelinaro.org/clo/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/-/commit/f4743c978bbea4f7e05902f7c52d181f64e805b4</a><br>                                       </li></ul> |

### CVE-2026-25301

| CVE ID | CVE-2026-25301 |
| --- | --- |
| Title | Buffer Over-read in Graphics |
| Description | Memory Corruption when processing a snapshot of graphics data causes a global out-of-bounds memory access. |
| Technology Area | Graphics |
| Vulnerability Type | CWE-126 Buffer Over-read |
| Access Vector | Local |
| Security Rating | High |
| CVSS Rating | High |
| CVSS Score | 7.8 |
| CVSS String | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Date Reported | Internal |
| Customer Notified Date | 2026/08/03 |
| Affected Chipsets\* | Congo, FastConnect 6700, FastConnect 6900, FastConnect 7800, Orne, Pandeiro, QCA6391, QLN1083BD, QLN1086BD, QMP1000, QMP2001, QPA1083BD, QPA1086BD, Qualcomm® FastConnect™ 8800 Mobile Connectivity System, QXM1083, QXM1086, QXM1093, QXM1094, QXM1095, QXM1096, SAR1165P, SAR1230P, SC8380XP, SD865 5G, SM7325P, SM8950P, SM8975P, Snapdragon 460 Mobile Platform, Snapdragon 662 Mobile Platform, Snapdragon 778G 5G Mobile Platform, Snapdragon 778G+ 5G Mobile Platform, Snapdragon 782G Mobile Platform, Snapdragon 7c+ Gen 3 Compute, Snapdragon 8 Elite Extreme Gen 6, Snapdragon 8 Elite Gen 5, Snapdragon 8 Elite Gen 6, Snapdragon 8 Gen 5, Snapdragon 888 5G Mobile Platform, Snapdragon 888+ 5G Mobile Platform, Snapdragon AR1 Gen 1 Platform, Snapdragon AR1+ Gen 1 Platform, Snapdragon X53 5G Modem-RF System, Snapdragon XR2 5G Platform, Snapdragon XR2+ Gen 1 Platform, Snapdragon® Reality Elite Platform, SXR2230P, SXR2250P, WCD9370, WCD9375, WCD9378, WCD9380, WCD9385, WCD9395, WCN3950, WCN3988, WCN7860, WCN7861, WCN7880, WCN7881, WCN8841, WSA8810, WSA8815, WSA8830, WSA8832, WSA8835, WSA8840, WSA8845, WSA8845H, WSA8850, WSA8850W, WSA8855C, X1E80100, XRV7200, XRV7205, XRV7209, XRV9209 |
| Patch\*\* | <ul><li><br>                                             <a class="word-wrap" href="https://git.codelinaro.org/clo/la/platform/vendor/qcom/opensource/graphics-kernel/-/commit/be1b91c10f5d045f608e88e99598766f3865bfef" target="_blank">https://git.codelinaro.org/clo/la/platform/vendor/qcom/opensource/graphics-kernel/-/commit/be1b91c10f5d045f608e88e99598766f3865bfef</a><br>                                       </li></ul> |

### CVE-2026-57548

| CVE ID | CVE-2026-57548 |
| --- | --- |
| Title | Use After Free in Graphics |
| Description | Memory Corruption when processing commands during context detachment due to improper cleanup of graphics objects. |
| Technology Area | Graphics |
| Vulnerability Type | CWE-416 Use After Free |
| Access Vector | Local |
| Security Rating | High |
| CVSS Rating | High |
| CVSS Score | 7.8 |
| CVSS String | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Date Reported | 2026/03/30 |
| Customer Notified Date | 2026/08/03 |
| Affected Chipsets\* | Snapdragon G1 Gen 2 Gaming Platform, Cologne, CQ8850NS, CSRA6620, CSRA6640, FastConnect 6200, FastConnect 6700, FastConnect 6900, FastConnect 7800, G1 Gen 1, G2 Gen 1, IQ6 Series Platform, IQ8 Series Platform, IQ9 Series Platform, LeMans\_AU\_LGIT, LeMansAU, MBM415, Monaco\_IOT, Netrani, Orne, Pandeiro, Q-2390, QAM8255P, QAM8295P, QAMSRV1H, QAMSRV1M, QCA6391, QCA6574, QCA6574A, QCA6574AU, QCA6595, QCA6595AU, QCA6688AQ, QCA6696, QCA6698AQ, QCA6797AQ, QCA8695AU, QCC2070, QCM2290, QCM4290, QCM5430, QCM6490, QCS2290, QCS4290, QLN1083BD, QLN1086BD, QMP1000, QMP2001, QPA1083BD, QPA1086BD, Qualcomm Dragonwing™ Q-8845, Qualcomm Dragonwing™ QCM4490, Qualcomm® Video Collaboration VC3 Platform, QXM1083, QXM1086, QXM1093, QXM1094, QXM1095, QXM1096, SA6155P, SA7255P, SA7775P, SA8155P, SA8195P, SA8255P, SA8295P, SA8620P, SA8770P, SA9000P, SAR1165P, SC8380XP, SD 8 Gen1 5G, SD662, SD865 5G, SM4875, SM6225P, SM6450P, SM6475P, SM6475Q, SM6850, SM7325P, SM7435, SM7435P, SM7635P, SM8475P, SM8845P, Smart Audio 400 Platform, Snapdragon 4 Gen 2 Mobile Platform, Snapdragon 460 Mobile Platform, Snapdragon 6 Gen 1 Mobile Platform, Snapdragon 6 Gen 3 Mobile Platform, Snapdragon 662 Mobile Platform, Snapdragon 680 4G Mobile Platform, Snapdragon 685 4G Mobile Platform, Snapdragon 7 Gen 1 Mobile Platform, Snapdragon 7+ Gen 2 Mobile Platform, Snapdragon 778G 5G Mobile Platform, Snapdragon 778G+ 5G Mobile Platform, Snapdragon 782G Mobile Platform, Snapdragon 7c+ Gen 3 Compute, Snapdragon 8 Elite Gen 5, Snapdragon 8 Gen 1 Mobile Platform, Snapdragon 8 Gen 5, Snapdragon 8+ Gen 1 Mobile Platform, Snapdragon 888 5G Mobile Platform, Snapdragon 888+ 5G Mobile Platform, Snapdragon AR1 Gen 1 Platform, Snapdragon AR1+ Gen 1 Platform, Snapdragon Ride™ Elite , Snapdragon W5+ Gen 1 Wearable Platform, Snapdragon X53 5G Modem-RF System, Snapdragon XR2 5G Platform, Snapdragon XR2+ Gen 1 Platform, Snapdragon® Cockpit Elite, Snapdragon® Reality Elite Platform, Snapdragon® Wear Elite platform, SRV1H, SRV1M, SW5100, SW5100P, SXR2230P, SXR2250P, Themisto, WCD9335, WCD9370, WCD9375, WCD9378, WCD9380, WCD9385, WCD9395, WCN3950, WCN3988, WCN6450, WCN6755, WCN7760, WCN7860, WCN7861, WCN7880, WCN7881, WSA8810, WSA8815, WSA8830, WSA8832, WSA8835, WSA8840, WSA8845, WSA8845H, WSA8850, WSA8850W, WSA8855C, X1E80100, X1P42100, X1P44100, X1P46100, XRV7209, XRV9209 |
| Patch\*\* | <ul><li><br>                                             <a class="word-wrap" href="https://git.codelinaro.org/clo/la/platform/vendor/qcom/opensource/graphics-kernel/-/commit/af2e26b0b01a5ca8ef30bf20ee17a1360563bb70<br>" target="_blank">https://git.codelinaro.org/clo/la/platform/vendor/qcom/opensource/graphics-kernel/-/commit/af2e26b0b01a5ca8ef30bf20ee17a1360563bb70<br></a><br>                                       </li><li><br>                                             <a class="word-wrap" href="https://git.codelinaro.org/clo/la/platform/vendor/qcom/opensource/graphics-kernel/-/commit/73214990504422a964b091964cde3c59780b7ff2" target="_blank">https://git.codelinaro.org/clo/la/platform/vendor/qcom/opensource/graphics-kernel/-/commit/73214990504422a964b091964cde3c59780b7ff2</a><br>                                       </li></ul> |

### CVE-2026-57549

| CVE ID | CVE-2026-57549 |
| --- | --- |
| Title | Use After Free in Graphics |
| Description | Memory corruption when processing hardware fence lists during GPU context teardown due to missing synchronization protection. |
| Technology Area | Graphics |
| Vulnerability Type | CWE-416 Use After Free |
| Access Vector | Local |
| Security Rating | High |
| CVSS Rating | High |
| CVSS Score | 7.8 |
| CVSS String | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Date Reported | 2026/03/24 |
| Customer Notified Date | 2026/08/03 |
| Affected Chipsets\* | Cologne, CQ7790, FastConnect 6200, FastConnect 6700, FastConnect 6900, FastConnect 7800, IQ9 Series Platform, Kalpeni, LeMans\_AU\_LGIT, LeMansAU, Milos, Netrani, Orne, Pandeiro, Q-4390, QAM8255P, QAM8295P, QAMSRV1H, QAMSRV1M, QCA6391, QCA6574, QCA6574A, QCA6574AU, QCA6595, QCA6595AU, QCA6678AQ, QCA6688AQ, QCA6696, QCA6698AQ, QCA6797AQ, QCA8695AU, QCM2290, QCM4290, QCS2290, QCS4290, QLN1083BD, QLN1086BD, QMP1000, QMP2001, QPA1083BD, QPA1086BD, Qualcomm Dragonwing™ Q-7790, Qualcomm Dragonwing™ Q-8845, Qualcomm Dragonwing™ QCM4490, Qualcomm® Video Collaboration VC1 Platform, Qualcomm® Video Collaboration VC3 Platform, QXM1093, QXM1094, QXM1095, QXM1096, SA6155P, SA7255P, SA7775P, SA8155P, SA8195P, SA8255P, SA8295P, SA8620P, SA8770P, SA9000P, SC8380XP, SD662, SD865 5G, SM4875, SM6225P, SM6650P, SM6850, SM7325P, SM7435, SM7635P, SM7675, SM7675P, SM8635, SM8635P, SM8650Q, SM8845P, Snapdragon 460 Mobile Platform, Snapdragon 6 Gen 1 Mobile Platform, Snapdragon 6 Gen 3 Mobile Platform, Snapdragon 6 Gen 4 Mobile Platform, Snapdragon 662 Mobile Platform, Snapdragon 680 4G Mobile Platform, Snapdragon 685 4G Mobile Platform, Snapdragon 778G 5G Mobile Platform, Snapdragon 778G+ 5G Mobile Platform, Snapdragon 782G Mobile Platform, Snapdragon 7c+ Gen 3 Compute, Snapdragon 7s Gen 3 Mobile Platform, Snapdragon 8 Elite, Snapdragon 8 Elite Gen 5, Snapdragon 8 Gen 3 Mobile Platform, Snapdragon 8 Gen 5, Snapdragon 888 5G Mobile Platform, Snapdragon 888+ 5G Mobile Platform, Snapdragon AR1 Gen 1 Platform, Snapdragon Ride™ Elite , Snapdragon W5+ Gen 1 Wearable Platform, Snapdragon X53 5G Modem-RF System, Snapdragon XR2 5G Platform, Snapdragon XR2+ Gen 1 Platform, Snapdragon® Cockpit Elite, Snapdragon® Reality Elite Platform, Snapdragon® Wear Elite platform, SRV1H, SRV1M, SW-only, SW5100, SW5100P, SXR2230P, SXR2250P, Themisto, WCD9370, WCD9375, WCD9378, WCD9380, WCD9385, WCD9390, WCD9395, WCN3950, WCN3980, WCN3988, WCN6450, WCN6650, WCN6755, WCN7760, WCN7860, WCN7861, WCN7880, WCN7881, WSA8810, WSA8815, WSA8830, WSA8832, WSA8835, WSA8840, WSA8845, WSA8845H, WSA8850, WSA8850W, WSA8855C, X1E80100, XRV7209, XRV9209 |
| Patch\*\* | <ul><li><br>                                             <a class="word-wrap" href="https://git.codelinaro.org/clo/la/platform/vendor/qcom/opensource/graphics-kernel/-/commit/9f382f0cbb0c69b0ddc90e298ca5226b4ecd80a9" target="_blank">https://git.codelinaro.org/clo/la/platform/vendor/qcom/opensource/graphics-kernel/-/commit/9f382f0cbb0c69b0ddc90e298ca5226b4ecd80a9</a><br>                                       </li></ul> |

### CVE-2026-65072

| CVE ID | CVE-2026-65072 |
| --- | --- |
| Title | Buffer Over-read in Automotive GPU |
| Description | Memory Corruption when processing GPU memory profiling buffers with invalid offsets exceeds allocated memory bounds. |
| Technology Area | Automotive GPU |
| Vulnerability Type | CWE-126 Buffer Over-read |
| Access Vector | Local |
| Security Rating | High |
| CVSS Rating | High |
| CVSS Score | 7.8 |
| CVSS String | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Date Reported | 2026/04/17 |
| Customer Notified Date | 2026/08/03 |
| Affected Chipsets\* | FastConnect 6200, FastConnect 6700, FastConnect 6900, FastConnect 7800, Kalpeni, LeMans\_AU\_LGIT, LeMansAU, Milos, Pandeiro, QAM8255P, QCA6595AU, QCA6698AQ, QCA6797AQ, QCA8695AU, QCA9367, QCA9377, QLN1083BD, QLN1086BD, QPA1083BD, QPA1086BD, Qualcomm Dragonwing™ Q-6690, QXM1083, QXM1086, QXM1093, QXM1094, QXM1095, QXM1096, SA7255P, SA7775P, SA8255P, SAR1165P, SAR2130P, SD865 5G, SM6650P, SM7635P, SM7675, SM7675P, SM8635, SM8635P, SM8650Q, Snapdragon 4 Gen 1 Mobile Platform, Snapdragon 4 Gen 2 Mobile Platform, Snapdragon 460 Mobile Platform, Snapdragon 480 5G Mobile Platform, Snapdragon 480+ 5G Mobile Platform, Snapdragon 6 Gen 4 Mobile Platform, Snapdragon 662 Mobile Platform, Snapdragon 695 5G Mobile Platform, Snapdragon 7s Gen 3 Mobile Platform, Snapdragon 8 Gen 3 Mobile Platform, Snapdragon AR1 Gen 1 Platform, Snapdragon AR1+ Gen 1 Platform, Snapdragon Ride™ Elite , Snapdragon XR2 5G Platform, Snapdragon XR2+ Gen 1 Platform, Snapdragon® Cockpit Elite, Snapdragon® Reality Elite Platform, SXR2230P, SXR2250P, WCD9370, WCD9375, WCD9378, WCD9380, WCD9385, WCD9390, WCD9395, WCN3950, WCN3988, WCN6450, WCN6650, WCN6755, WCN7860, WCN7861, WCN7881, WSA8810, WSA8815, WSA8830, WSA8832, WSA8835, WSA8840, WSA8845, WSA8845H, XRV7209, XRV9209 |
| Patch\*\* | <ul><li><br>                                             <a class="word-wrap" href="https://git.codelinaro.org/clo/la/platform/vendor/qcom/opensource/graphics-hgsl/-/commit/38a2e3a87c792c35be50f34667395f9486b7d697<br>" target="_blank">https://git.codelinaro.org/clo/la/platform/vendor/qcom/opensource/graphics-hgsl/-/commit/38a2e3a87c792c35be50f34667395f9486b7d697<br></a><br>                                       </li><li><br>                                             <a class="word-wrap" href="https://git.codelinaro.org/clo/la/kernel/qcom/-/commit/40fd04b4294eab86bb9dfb933d796f01599f6326" target="_blank">https://git.codelinaro.org/clo/la/kernel/qcom/-/commit/40fd04b4294eab86bb9dfb933d796f01599f6326</a><br>                                       </li></ul> |

### CVE-2026-66113

| CVE ID | CVE-2026-66113 |
| --- | --- |
| Title | Use After Free in Display |
| Description | Memory corruption when importing a malformed handle causes unintended memory ranges to be unmapped in privileged processes. |
| Technology Area | Display |
| Vulnerability Type | CWE-416 Use After Free |
| Access Vector | Local |
| Security Rating | High |
| CVSS Rating | High |
| CVSS Score | 7.8 |
| CVSS String | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Date Reported | 2026/05/10 |
| Customer Notified Date | 2026/08/03 |
| Affected Chipsets\* | Cologne, Congo, CQ7790, CQ8725S, CQ8750M, CQ8850NS, CSRA6620, CSRA6640, FastConnect 6200, FastConnect 6700, FastConnect 6900, FastConnect 7800, G2 Gen 1, IQ10 Series, MBM415, MBM715, Netrani, Orne, Palawan25, Pandeiro, Q-2390, Q-4390, QCA6595AU, QCA6698AQ, QCA6797AQ, QCA8695AU, QCC2070, QCM2290, QCM4290, QCM8838, QCS2290, QCS4290, QLN1083BD, QLN1086BD, QMP1000, QMP2001, QPA1083BD, QPA1086BD, Qualcomm Dragonwing™ Q-7790, Qualcomm Dragonwing™ Q-8845, Qualcomm Dragonwing™ QCM4490, Qualcomm® FastConnect™ 8800 Mobile Connectivity System, QXM1093, QXM1094, QXM1095, QXM1096, SAR1165P, SAR1230P, SC8380XP, SD662, SD865 5G, SDR753, SM4850, SM4850P, SM4875, SM6225P, SM6450P, SM6475P, SM6475Q, SM6850, SM7435, SM7435P, SM7635P, SM7750P, SM8735P, SM8750P, SM8845P, SM8950P, SM8975P, Smart Audio 400 Platform, Snapdragon 4 Gen 2 Mobile Platform, Snapdragon 460 Mobile Platform, Snapdragon 6 Gen 1 Mobile Platform, Snapdragon 6 Gen 3 Mobile Platform, Snapdragon 662 Mobile Platform, Snapdragon 680 4G Mobile Platform, Snapdragon 685 4G Mobile Platform, Snapdragon 7 Gen 4 Mobile Platform, Snapdragon 8 Elite, Snapdragon 8 Elite Extreme Gen 6, Snapdragon 8 Elite Gen 5, Snapdragon 8 Elite Gen 6, Snapdragon 8 Gen 5, Snapdragon AR1 Gen 1 Platform, Snapdragon AR1+ Gen 1 Platform, Snapdragon Ride™ Elite , Snapdragon W5+ Gen 1 Wearable Platform, Snapdragon XR2 5G Platform, Snapdragon XR2+ Gen 1 Platform, Snapdragon® Cockpit Elite, Snapdragon® Reality Elite Platform, Snapdragon® Wear Elite platform, SW-only, SW5100, SW5100P, SXR2230P, SXR2250P, Themisto, WCD9335, WCD9370, WCD9375, WCD9378, WCD9380, WCD9385, WCD9395, WCN3950, WCN3988, WCN6450, WCN6755, WCN7760, WCN7860, WCN7861, WCN7880, WCN7881, WCN8841, WSA8810, WSA8815, WSA8830, WSA8832, WSA8835, WSA8840, WSA8845, WSA8845H, WSA8850, WSA8850W, WSA8855C, X1E80100, X1P42100, X1P44100, X1P46100, XRV7200, XRV7205, XRV7209, XRV9209 |
| Patch\*\* | <ul><li><br>                                             <a class="word-wrap" href="https://git.codelinaro.org/clo/la/platform/vendor/opensource/display-core/-/commit/1d51d6c52ccc5e9ac759aded27a4ec62a7ccf702" target="_blank">https://git.codelinaro.org/clo/la/platform/vendor/opensource/display-core/-/commit/1d51d6c52ccc5e9ac759aded27a4ec62a7ccf702</a><br>                                       </li></ul> |

### CVE-2026-66114

| CVE ID | CVE-2026-66114 |
| --- | --- |
| Title | Buffer Copy Without Checking Size of Input in Display |
| Description | Memory corruption when processing metadata with unvalidated buffer size exceeds destination buffer capacity. |
| Technology Area | Display |
| Vulnerability Type | CWE-120 Buffer Copy Without Checking Size of Input ('Classic Buffer Overflow') |
| Access Vector | Local |
| Security Rating | High |
| CVSS Rating | High |
| CVSS Score | 7.8 |
| CVSS String | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Date Reported | 2026/05/10 |
| Customer Notified Date | 2026/08/03 |
| Affected Chipsets\* | Cologne, Congo, CQ7790, CQ8725S, CQ8750M, CQ8850NS, CSRA6620, CSRA6640, FastConnect 6200, FastConnect 6700, FastConnect 6900, FastConnect 7800, IQ10 Series, MBM715, Orne, Palawan25, Pandeiro, Q-2390, QCA6595AU, QCA6698AQ, QCA6797AQ, QCA8695AU, QCC2070, QCM2290, QCM4290, QCM8838, QCS2290, QCS4290, QLN1083BD, QLN1086BD, QMP1000, QMP2001, QPA1083BD, QPA1086BD, Qualcomm Dragonwing™ Q-7790, Qualcomm Dragonwing™ Q-8845, Qualcomm® FastConnect™ 8800 Mobile Connectivity System, QXM1093, QXM1094, QXM1095, QXM1096, SAR1230P, SC8380XP, SD662, SDR753, SM4850, SM4850P, SM4875, SM6225P, SM6850, SM7750P, SM8735P, SM8750P, SM8845P, SM8950P, SM8975P, Smart Audio 400 Platform, Snapdragon 460 Mobile Platform, Snapdragon 662 Mobile Platform, Snapdragon 680 4G Mobile Platform, Snapdragon 685 4G Mobile Platform, Snapdragon 7 Gen 4 Mobile Platform, Snapdragon 8 Elite, Snapdragon 8 Elite Extreme Gen 6, Snapdragon 8 Elite Gen 5, Snapdragon 8 Elite Gen 6, Snapdragon 8 Gen 5, Snapdragon AR1 Gen 1 Platform, Snapdragon Ride™ Elite , Snapdragon W5+ Gen 1 Wearable Platform, Snapdragon® Cockpit Elite, Snapdragon® Reality Elite Platform, Snapdragon® Wear Elite platform, SW-only, SW5100, SW5100P, SXR2230P, SXR2250P, Themisto, WCD9335, WCD9370, WCD9375, WCD9378, WCD9380, WCD9385, WCD9395, WCN3950, WCN3988, WCN6450, WCN6755, WCN7760, WCN7860, WCN7861, WCN7880, WCN7881, WCN8841, WSA8810, WSA8830, WSA8832, WSA8835, WSA8840, WSA8845, WSA8845H, WSA8850, WSA8850W, WSA8855C, X1E80100, X1P42100, X1P44100, X1P46100, XRV7200, XRV7205, XRV7209, XRV9209 |
| Patch\*\* | <ul><li><br>                                             <a class="word-wrap" href="https://git.codelinaro.org/clo/la/platform/vendor/opensource/display-core/-/commit/0a615ffd20a5677ca18acb53e9b4b1292b836078" target="_blank">https://git.codelinaro.org/clo/la/platform/vendor/opensource/display-core/-/commit/0a615ffd20a5677ca18acb53e9b4b1292b836078</a><br>                                       </li></ul> |

### CVE-2026-80013

| CVE ID | CVE-2026-80013 |
| --- | --- |
| Title | Integer Overflow or Wraparound in Data Network Stack & Connectivity |
| Description | Memory Corruption when initializing NAT table due to integer truncation bypassing boundary checks. |
| Technology Area | Data Network Stack & Connectivity |
| Vulnerability Type | CWE-190 Integer Overflow or Wraparound |
| Access Vector | Local |
| Security Rating | Medium |
| CVSS Rating | Medium |
| CVSS Score | 6.7 |
| CVSS String | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| Date Reported | 2026/05/14 |
| Customer Notified Date | 2026/10/05 |
| Affected Chipsets\* | Snapdragon G1 Gen 2 Gaming Platform, 5G Fixed Wireless Access Platform, AR8035, C-V2X 9150, Cologne, Congo, CQ7790, CQ8725S, CQ8750M, CQ8850NS, CSRB31024, FastConnect 6200, FastConnect 6700, FastConnect 6800, FastConnect 6900, FastConnect 7800, FSM100 Platform, FWA Gen 3 Ultra Platform, FWA Gen 5 Elite Platform, G1 Gen 1, G2 Gen 1, G3x Gen 2, Kalpeni, Kobuk, LeMans\_AU\_LGIT, LeMansAU, MBM415, MBM715, MDM9250, MDM9628, Milos, Netrani, Orne, Palawan25, Pandeiro, Q-2390, Q-4390, QAM8255P, QAM8295P, QAMSRV1H, QAMSRV1M, QCA6174A, QCA6391, QCA6564A, QCA6564AU, QCA6574, QCA6574A, QCA6574AU, QCA6584AU, QCA6595, QCA6595AU, QCA6678AQ, QCA6688AQ, QCA6696, QCA6698AQ, QCA6698AU, QCA6797AQ, QCA8081, QCA8337, QCA8386, QCA8695AU, QCA9367, QCA9377, QCC710, QCF8001, QCM2290, QCM4290, QCM4325, QCM5430, QCM6125, QCM6490, QCM8838, QCN6024, QCN6224, QCN6274, QCN9011, QCN9012, QCN9024, QCS2290, QCS4290, QCS8550, QEP8111, QFW7114, QFW7124, QFW7224, QLN1083BD, QLN1086BD, QMP1000, QMP2001, QMX82L, QMX85L, QPA1083BD, QPA1086BD, Qualcomm 215 Mobile Platform, Qualcomm Dragonwing™ Q-6690, Qualcomm Dragonwing™ Q-7790, Qualcomm Dragonwing™ Q-8845, Qualcomm Dragonwing™ QCM4490, Qualcomm Dragonwing™ QRB5165, Qualcomm® FastConnect™ 8800 Mobile Connectivity System, Qualcomm® Video Collaboration VC1 Platform, Qualcomm® Video Collaboration VC3 Platform, QXM1093, QXM1094, QXM1095, QXM1096, Robotics RB5 Platform, SA2150P, SA4150P, SA4155P, SA510M, SA6145P, SA6150P, SA6155, SA6155P, SA7255P, SA7775P, SA8145P, SA8150P, SA8155, SA8155P, SA8195P, SA8255P, SA8295P, SA8620P, SA8770P, SA9000P, SC8380XP, SD 8 Gen1 5G, SD662, SD865 5G, SDA660, SDM429W, SDR753, SDX61, SDX81, SM4850, SM4850P, SM4875, SM6225P, SM6450P, SM6475P, SM6475Q, SM6650P, SM6850, SM7325P, SM7435, SM7435P, SM7525, SM7550, SM7550P, SM7635P, SM7675, SM7675P, SM7750P, SM8475P, SM8550P, SM8635, SM8635P, SM8650Q, SM8735P, SM8750P, SM8845P, SM8950P, SM8975P, Snapdragon 4 Gen 1 Mobile Platform, Snapdragon 4 Gen 2 Mobile Platform, Snapdragon 429 Mobile Platform, Snapdragon 460 Mobile Platform, Snapdragon 480 5G Mobile Platform, Snapdragon 480+ 5G Mobile Platform, Snapdragon 6 Gen 1 Mobile Platform, Snapdragon 6 Gen 3 Mobile Platform, Snapdragon 6 Gen 4 Mobile Platform, Snapdragon 660 Mobile Platform, Snapdragon 662 Mobile Platform, Snapdragon 680 4G Mobile Platform, Snapdragon 685 4G Mobile Platform, Snapdragon 690 5G Mobile Platform, Snapdragon 695 5G Mobile Platform, Snapdragon 7 Gen 1 Mobile Platform, Snapdragon 7 Gen 4 Mobile Platform, Snapdragon 7+ Gen 2 Mobile Platform, Snapdragon 778G 5G Mobile Platform, Snapdragon 778G+ 5G Mobile Platform, Snapdragon 782G Mobile Platform, Snapdragon 7c+ Gen 3 Compute, Snapdragon 7s Gen 3 Mobile Platform, Snapdragon 8 Elite, Snapdragon 8 Elite Extreme Gen 6, Snapdragon 8 Elite Gen 5, Snapdragon 8 Elite Gen 6, Snapdragon 8 Gen 1 Mobile Platform, Snapdragon 8 Gen 2 Mobile Platform, Snapdragon 8 Gen 3 Mobile Platform, Snapdragon 8 Gen 5, Snapdragon 8+ Gen 1 Mobile Platform, Snapdragon 8+ Gen 2 Mobile Platform, Snapdragon 865 5G Mobile Platform, Snapdragon 865+ 5G Mobile Platform, Snapdragon 870 5G Mobile Platform, Snapdragon 888 5G Mobile Platform, Snapdragon 888+ 5G Mobile Platform, Snapdragon Auto 5G Modem-RF, Snapdragon Auto 5G Modem-RF Gen 2, Snapdragon Ride™ Elite , Snapdragon W5+ Gen 1 Wearable Platform, Snapdragon X12 LTE Modem, Snapdragon X32 5G Modem-RF System, Snapdragon X35 5G Modem-RF System, Snapdragon X53 5G Modem-RF System, Snapdragon X55 5G Modem-RF System, Snapdragon X62 5G Modem-RF System, Snapdragon X65 5G Modem-RF System, Snapdragon X72 5G Modem-RF System, Snapdragon X75 5G Modem-RF System, Snapdragon XR2 5G Platform, Snapdragon XR2+ Gen 1 Platform, Snapdragon Auto 4G Modem, Snapdragon® Cockpit Elite, Snapdragon® Reality Elite Platform, Snapdragon® Wear Elite platform, SRV1H, SRV1M, SW-only, SW5100, SW5100P, Themisto, Vision Intelligence 400 Platform, WCD9326, WCD9330, WCD9335, WCD9340, WCD9341, WCD9360, WCD9370, WCD9371, WCD9375, WCD9378, WCD9380, WCD9385, WCD9390, WCD9395, WCN3615, WCN3620, WCN3660B, WCN3680B, WCN3910, WCN3950, WCN3980, WCN3988, WCN3990, WCN6450, WCN6650, WCN6755, WCN7760, WCN7860, WCN7861, WCN7880, WCN7881, WCN8841, WSA8810, WSA8815, WSA8830, WSA8832, WSA8835, WSA8840, WSA8845, WSA8845H, WSA8850, WSA8850W, WSA8855C, X1E80100, XRV7209, XRV9209 |
| Patch\*\* | <ul><li><br>                                             <a class="word-wrap" href="https://git.codelinaro.org/clo/la/platform/vendor/opensource/dataipa/-/commit/d2105aee6db377572c116d16b751dc0f0266728d" target="_blank">https://git.codelinaro.org/clo/la/platform/vendor/opensource/dataipa/-/commit/d2105aee6db377572c116d16b751dc0f0266728d</a><br>                                       </li></ul> |

### CVE-2026-80015

| CVE ID | CVE-2026-80015 |
| --- | --- |
| Title | Use After Free in Data Network Stack & Connectivity |
| Description | Memory Corruption when stale SMMU mappings persist after NAT/IPv6 connection tracking table memory is freed in fastmap mode. |
| Technology Area | Data Network Stack & Connectivity |
| Vulnerability Type | CWE-416 Use After Free |
| Access Vector | Local |
| Security Rating | Medium |
| CVSS Rating | Medium |
| CVSS Score | 6.7 |
| CVSS String | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| Date Reported | 2026/05/14 |
| Customer Notified Date | 2026/10/05 |
| Affected Chipsets\* | Snapdragon G1 Gen 2 Gaming Platform, AR8031, AR8035, Cologne, Congo, CQ7790, CQ8750M, CQ8850NS, CSRA6620, CSRA6640, FastConnect 6200, FastConnect 6700, FastConnect 6900, FastConnect 7800, G1 Gen 1, G2 Gen 1, G3x Gen 2, MBM415, MBM715, MDM9250, MDM9628, Milos, Netrani, Orne, Palawan25, Pandeiro, Q-2390, Q-4390, QAM8255P, QAM8295P, QCA2066, QCA6174A, QCA6391, QCA6564A, QCA6564AU, QCA6574, QCA6574A, QCA6574AU, QCA6595, QCA6595AU, QCA6678AQ, QCA6696, QCA6698AQ, QCA6698AU, QCA6797AQ, QCA8081, QCA8337, QCA9377, QCM2290, QCM4290, QCM4325, QCM5430, QCM6125, QCM6490, QCM8838, QCN6024, QCN9011, QCN9012, QCN9024, QCS2290, QCS4290, QCS8550, QMP1000, QMP2001, Qualcomm Dragonwing™ Q-7790, Qualcomm Dragonwing™ Q-8845, Qualcomm Dragonwing™ QCM4490, Qualcomm® FastConnect™ 8800 Mobile Connectivity System, Qualcomm® Video Collaboration VC1 Platform, Qualcomm® Video Collaboration VC3 Platform, Qualcomm® Video Collaboration VC5 Platform, Robotics RB2 Platform, SA4150P, SA4155P, SA6145P, SA6150P, SA6155P, SA8145P, SA8150P, SA8155P, SA8195P, SA8255P, SA8295P, SAR1165P, SAR2130P, SC8380XP, SD 8 Gen1 5G, SD662, SDR753, SDX61, SM4850, SM4850P, SM4875, SM6225P, SM6450P, SM6475P, SM6475Q, SM6650P, SM6850, SM7325P, SM7435, SM7435P, SM7525, SM7550, SM7550P, SM7635P, SM7675, SM7675P, SM7750P, SM8475P, SM8550P, SM8635, SM8635P, SM8650Q, SM8735P, SM8750P, SM8845P, SM8950P, SM8975P, Smart Audio 400 Platform, Snapdragon 4 Gen 1 Mobile Platform, Snapdragon 4 Gen 2 Mobile Platform, Snapdragon 460 Mobile Platform, Snapdragon 480 5G Mobile Platform, Snapdragon 480+ 5G Mobile Platform, Snapdragon 6 Gen 1 Mobile Platform, Snapdragon 6 Gen 3 Mobile Platform, Snapdragon 6 Gen 4 Mobile Platform, Snapdragon 662 Mobile Platform, Snapdragon 680 4G Mobile Platform, Snapdragon 685 4G Mobile Platform, Snapdragon 695 5G Mobile Platform, Snapdragon 7 Gen 1 Mobile Platform, Snapdragon 7 Gen 4 Mobile Platform, Snapdragon 7+ Gen 2 Mobile Platform, Snapdragon 778G 5G Mobile Platform, Snapdragon 778G+ 5G Mobile Platform, Snapdragon 782G Mobile Platform, Snapdragon 7c+ Gen 3 Compute, Snapdragon 7s Gen 3 Mobile Platform, Snapdragon 8 Elite, Snapdragon 8 Elite Extreme Gen 6, Snapdragon 8 Elite Gen 5, Snapdragon 8 Elite Gen 6, Snapdragon 8 Gen 1 Mobile Platform, Snapdragon 8 Gen 2 Mobile Platform, Snapdragon 8 Gen 3 Mobile Platform, Snapdragon 8 Gen 5, Snapdragon 8+ Gen 1 Mobile Platform, Snapdragon 8+ Gen 2 Mobile Platform, Snapdragon 888 5G Mobile Platform, Snapdragon 888+ 5G Mobile Platform, Snapdragon AR1 Gen 1 Platform, Snapdragon AR1+ Gen 1 Platform, Snapdragon Auto 5G Modem-RF, Snapdragon W5+ Gen 1 Wearable Platform, Snapdragon X12 LTE Modem, Snapdragon X53 5G Modem-RF System, Snapdragon X62 5G Modem-RF System, Snapdragon X65 5G Modem-RF System, Snapdragon® Wear Elite platform, SW-only, SW5100, SW5100P, SXR2230P, SXR2250P, Themisto, WCD9335, WCD9370, WCD9371, WCD9375, WCD9378, WCD9380, WCD9385, WCD9390, WCD9395, WCN3910, WCN3950, WCN3980, WCN3988, WCN6450, WCN6650, WCN6755, WCN7760, WCN7860, WCN7861, WCN7880, WCN7881, WCN8841, WSA8810, WSA8815, WSA8830, WSA8832, WSA8835, WSA8840, WSA8845, WSA8845H, WSA8850, WSA8850W, WSA8855C, X1E80100 |
| Patch\*\* | <ul><li><br>                                             <a class="word-wrap" href="https://git.codelinaro.org/clo/la/platform/vendor/qcom-opensource/data-devicetree/-/commit/bc798a6203c70fadbb02d45fe5c204fd167455e0" target="_blank">https://git.codelinaro.org/clo/la/platform/vendor/qcom-opensource/data-devicetree/-/commit/bc798a6203c70fadbb02d45fe5c204fd167455e0</a><br>                                       </li></ul> |

\* The list of affected chipsets may not be complete.
                For latest information, device OEMs can contact QTI directly at [www.qualcomm.com/support](https://www.qualcomm.com/support).

\*\* Data is generated only at the time of bulletin creation

## Industry Coordination

Security ratings of issues included in Android security
                bulletins and these bulletins match in the most common scenarios but may
                differ in some cases due to one of the following reasons:

- Consideration of security protections such as SELinux not enforced on some platforms
- Differences in assessment of some specific
                    scenarios that involves local denial of service or privilege escalation
                    vulnerabilities in the high level OS kernel

All Qualcomm products mentioned herein are products of Qualcomm Technologies, Inc. and/or its subsidiaries.

Qualcomm is a trademark of Qualcomm Incorporated, registered in the United States and other countries. Other product and brand names may be trademarks or registered trademarks of their respective owners.

This technical data may be subject to U.S. and international export, re-export, or transfer (“export”) laws. Diversion contrary to U.S. and international law is strictly prohibited.

Qualcomm Technologies, Inc.

San Diego, CA 92121

U.S.A.

© 2022 Qualcomm Technologies, Inc. and/or its subsidiaries. All rights reserved.