CVE-2026-25291: CWE-416 Use After Free in Qualcomm, Inc. Snapdragon

This vulnerability (CVE-2026-25291) involves a use-after-free condition (CWE-416) in Qualcomm Snapdragon devices. It occurs due to a lack of proper synchronization mechanisms when performing concurrent operations on shared memory page lists, leading to memory corruption. The CVSS 3.1 base score is 7.8, indicating high severity with local attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. The affected products include a broad range of Qualcomm Snapdragon chipsets and components identified by specific model numbers. There is no vendor advisory or patch information available at this time.

Successful exploitation of this vulnerability could allow an attacker with local access and low privileges to cause memory corruption, potentially resulting in complete compromise of confidentiality, integrity, and availability of the affected device. This could lead to arbitrary code execution or system crashes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, limit local access to trusted users and monitor for any unusual device behavior.