This vulnerability (CVE-2026-21383) involves a cryptographic issue where a static initialization vector (nonce) is reused in AES-GCM key wrapping within Qualcomm Snapdragon products. AES-GCM requires a unique nonce for each encryption call to maintain security guarantees. Reusing the nonce can lead to serious cryptographic failures, including loss of confidentiality and integrity of the wrapped keys. The affected products include various Snapdragon chipsets such as QCA6696, QDU1000 series, QDX1010 series, QXM1093-1096, WCD9380 series, WCN3950, WCN7860 series, WSA8830 series, and XRV7209/9209. The CVSS 3.1 base score is 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), reflecting a high impact on confidentiality and integrity with low attack complexity but requiring local privileges. No vendor advisory or patch information is currently provided.

Successful exploitation of this vulnerability could allow an attacker with local privileges to compromise the confidentiality and integrity of cryptographic keys wrapped using AES-GCM with a reused nonce. This undermines the security of encrypted data protected by these keys. There is no indication of impact on availability. The vulnerability does not appear to be exploited in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should follow Qualcomm's security advisories and consider limiting local access to affected devices to reduce risk. Avoid relying on affected cryptographic key wrapping implementations if possible.