Time-of-check Time-of-use (TOCTOU) Race Condition in Qualcomm products - CVE-2025-21455
Published: September 1, 2025
Vulnerability identifier: #VU114627
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-21455
CWE-ID: CWE-367
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Camera_Linux. A local application can execute arbitrary code.
Affected software
Snapdragon XR2 5G Platform
WSA8835
WSA8830
WSA8815
WSA8810
WCN3988
WCN3980
WCD9385
WCD9380
SXR2250P
SXR2230P
SW5100P
SW5100
FastConnect 6800
Snapdragon X55 5G Modem-RF System
Snapdragon 870 5G Mobile Platform (SM8250-AC)
Snapdragon 865+ 5G Mobile Platform (SM8250-AB)
Snapdragon 865 5G Mobile Platform
Snapdragon 8 Gen 1 Mobile Platform
SD865 5G
QSM8250
QCA6436
QCA6426
QCA6391
FastConnect 7800
FastConnect 6900
WSA8832
SXR2130
SDX55
WSA8835
WSA8830
WSA8815
WSA8810
WCN3988
WCN3980
WCD9385
WCD9380
SXR2250P
SXR2230P
SW5100P
SW5100
FastConnect 6800
Snapdragon X55 5G Modem-RF System
Snapdragon 870 5G Mobile Platform (SM8250-AC)
Snapdragon 865+ 5G Mobile Platform (SM8250-AB)
Snapdragon 865 5G Mobile Platform
Snapdragon 8 Gen 1 Mobile Platform
SD865 5G
QSM8250
QCA6436
QCA6426
QCA6391
FastConnect 7800
FastConnect 6900
WSA8832
SXR2130
SDX55
How to mitigate CVE-2025-21455
Install security update from vendor's website.