Medium · published July 7, 2026
Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input due to accessing already freed memory.
| Product | Versions | Fixed in |
|---|---|---|
| qualcomm/fastconnect_6700_firmware | all versions | — |
| qualcomm/fastconnect_6900_firmware | all versions | — |
| qualcomm/fastconnect_7800_firmware | all versions | — |
| qualcomm/molokai_firmware | all versions | — |
| qualcomm/orne_firmware | all versions | — |
| qualcomm/pandeiro_firmware | all versions | — |
| qualcomm/qcm5430_firmware | all versions | — |
| qualcomm/qcm6490_firmware | all versions | — |
| qualcomm/qmp1000_firmware | all versions | — |
| qualcomm/qmp2001_firmware | all versions | — |
| qualcomm/video_collaboration_vc3_platform_firmware | all versions | — |
| qualcomm/sc8380xp_firmware | all versions | — |
| qualcomm/sd865_5g_firmware | all versions | — |
| qualcomm/sm6850_firmware | all versions | — |
| qualcomm/sm8845p_firmware | all versions | — |
| qualcomm/snapdragon_460_mobile_platform_firmware | all versions | — |
| qualcomm/snapdragon_662_mobile_platform_firmware | all versions | — |
| qualcomm/snapdragon_8_elite_gen_5_firmware | all versions | — |
| qualcomm/snapdragon_ar1_gen_1_platform_firmware | all versions | — |
| qualcomm/snapdragon_xr2_5g_platform_firmware | all versions | — |
| qualcomm/snapdragon_xr2\+_gen_1_platform_firmware | all versions | — |
| qualcomm/sxr2230p_firmware | all versions | — |
| qualcomm/sxr2250p_firmware | all versions | — |
| qualcomm/wcd9370_firmware | all versions | — |
| qualcomm/wcd9375_firmware | all versions | — |
| qualcomm/wcd9378_firmware | all versions | — |
| qualcomm/wcd9380_firmware | all versions | — |
| qualcomm/wcd9385_firmware | all versions | — |
| qualcomm/wcd9395_firmware | all versions | — |
| qualcomm/wcn3950_firmware | all versions | — |
| qualcomm/wcn3988_firmware | all versions | — |
| qualcomm/wcn6450_firmware | all versions | — |
| qualcomm/wcn7760_firmware | all versions | — |
| qualcomm/wcn7860_firmware | all versions | — |
| qualcomm/wcn7861_firmware | all versions | — |
| qualcomm/wcn7880_firmware | all versions | — |
| qualcomm/wcn7881_firmware | all versions | — |
| qualcomm/wsa8810_firmware | all versions | — |
| qualcomm/wsa8815_firmware | all versions | — |
| qualcomm/wsa8830_firmware | all versions | — |
| qualcomm/wsa8832_firmware | all versions | — |
| qualcomm/wsa8835_firmware | all versions | — |
| qualcomm/wsa8840_firmware | all versions | — |
| qualcomm/wsa8845_firmware | all versions | — |
| qualcomm/wsa8845h_firmware | all versions | — |
| qualcomm/wsa8850_firmware | all versions | — |
| qualcomm/wsa8850w_firmware | all versions | — |
| qualcomm/wsa8855c_firmware | all versions | — |