---
id: CVE-2025-21456
title: Use After Free in NPU
summary: >-
  Memory corruption while processing IOCTL command when multiple threads are
  called to map/unmap buffer concurrently.
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-416
vendor: 'Qualcomm, Inc.'
product: Snapdragon
affected:
  - Snapdragon AR8035
  - Snapdragon C-V2X 9150
  - Snapdragon FastConnect 6900
  - Snapdragon FastConnect 7800
  - Snapdragon QAM8255P
  - Snapdragon QAM8295P
  - Snapdragon QAM8650P
  - Snapdragon QAM8775P
  - Snapdragon QCA6174A
  - Snapdragon QCA6574AU
  - Snapdragon QCA6584AU
  - Snapdragon QCA6696
  - Snapdragon QCA6698AQ
  - Snapdragon QCA6797AQ
  - Snapdragon QCA8081
  - Snapdragon QCA8337
  - Snapdragon QCC710
  - Snapdragon QCN6224
  - Snapdragon QCN6274
  - Snapdragon QCS410
  - Snapdragon QCS610
  - Snapdragon QFW7114
  - Snapdragon QFW7124
  - Snapdragon Qualcomm Video Collaboration VC1 Platform
  - Snapdragon Qualcomm Video Collaboration VC3 Platform
  - Snapdragon SA6145P
  - Snapdragon SA6150P
  - Snapdragon SA6155P
  - Snapdragon SA7255P
  - Snapdragon SA7775P
  - Snapdragon SA8145P
  - Snapdragon SA8150P
  - Snapdragon SA8155P
  - Snapdragon SA8195P
  - Snapdragon SA8255P
  - Snapdragon SA8295P
  - Snapdragon SA8530P
  - Snapdragon SA8540P
  - Snapdragon SA8620P
  - Snapdragon SA8650P
  - Snapdragon SA8775P
  - Snapdragon SA9000P
  - Snapdragon Snapdragon 888 5G Mobile Platform
  - Snapdragon Snapdragon 888+ 5G Mobile Platform (SM8350-AC)
  - Snapdragon Snapdragon Auto 5G Modem-RF Gen 2
  - Snapdragon Snapdragon W5+ Gen 1 Wearable Platform
  - Snapdragon Snapdragon X72 5G Modem-RF System
  - Snapdragon Snapdragon X75 5G Modem-RF System
  - Snapdragon SW5100
  - Snapdragon SW5100P
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2025-08-07T03:55:14.073610Z'
published: '2025-08-06'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T22:02:54.816Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-21456'
references:
  - url: >-
      https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2025-bulletin.html
tags:
  - cve.org
epss: 0.00093
epssPercentile: 0.00562
ingestedAt: '2026-11-05T20:33:06.539Z'
---

## Overview

Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently.

## Affected

- `Snapdragon AR8035`
- `Snapdragon C-V2X 9150`
- `Snapdragon FastConnect 6900`
- `Snapdragon FastConnect 7800`
- `Snapdragon QAM8255P`
- `Snapdragon QAM8295P`
- `Snapdragon QAM8650P`
- `Snapdragon QAM8775P`
- `Snapdragon QCA6174A`
- `Snapdragon QCA6574AU`
- `Snapdragon QCA6584AU`
- `Snapdragon QCA6696`
- `Snapdragon QCA6698AQ`
- `Snapdragon QCA6797AQ`
- `Snapdragon QCA8081`
- `Snapdragon QCA8337`
- `Snapdragon QCC710`
- `Snapdragon QCN6224`
- `Snapdragon QCN6274`
- `Snapdragon QCS410`
- `Snapdragon QCS610`
- `Snapdragon QFW7114`
- `Snapdragon QFW7124`
- `Snapdragon Qualcomm Video Collaboration VC1 Platform`
- `Snapdragon Qualcomm Video Collaboration VC3 Platform`
- `Snapdragon SA6145P`
- `Snapdragon SA6150P`
- `Snapdragon SA6155P`
- `Snapdragon SA7255P`
- `Snapdragon SA7775P`
- `Snapdragon SA8145P`
- `Snapdragon SA8150P`
- `Snapdragon SA8155P`
- `Snapdragon SA8195P`
- `Snapdragon SA8255P`
- `Snapdragon SA8295P`
- `Snapdragon SA8530P`
- `Snapdragon SA8540P`
- `Snapdragon SA8620P`
- `Snapdragon SA8650P`
- `Snapdragon SA8775P`
- `Snapdragon SA9000P`
- `Snapdragon Snapdragon 888 5G Mobile Platform`
- `Snapdragon Snapdragon 888+ 5G Mobile Platform (SM8350-AC)`
- `Snapdragon Snapdragon Auto 5G Modem-RF Gen 2`
- `Snapdragon Snapdragon W5+ Gen 1 Wearable Platform`
- `Snapdragon Snapdragon X72 5G Modem-RF System`
- `Snapdragon Snapdragon X75 5G Modem-RF System`
- `Snapdragon SW5100`
- `Snapdragon SW5100P`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.