Qualcomm Snapdragon GPU Address Deregistration Failure Denial of Service Vulnerability (CVE-2021-1906)
Executive & SecOps Summary
SECOPS ASSESSMENTAndroid and embedded devices powered by Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice & Music, and Wearables chipsets
A local attacker can trigger GPU memory allocation failures, leading to system resource exhaustion and a complete Denial of Service (DoS) on the affected device
Apply the official security patches released by Qualcomm and device OEMs (Samsung, Google, etc.) in or after May 2021
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Ensure that the Android or embedded Linux system is updated to the latest firmware containing the May 2021 (or later) security patch level. Use ADB to verify and trigger updates.
# Verify the current Android security patch level (Must be 2021-05-01 or later)
adb shell getprop ro.build.version.security_patch
# Force trigger system update check on AOSP-based devices
adb shell am start -n com.google.android.gms/.update.SystemUpdateActivity2. Temporary Workaround & Hardening Configuration
For legacy or embedded systems where immediate patching is not feasible, disable USB debugging and restrict local shell access to minimize the attack surface.
# Disable ADB debugging over network and USB
adb kill-server
# Programmatically disable USB debugging via shell settings
adb shell settings put global adb_enabled 03. Log Audit & IoC Verification Commands
Monitor the kernel ring buffer (dmesg) for repeated GPU memory allocation failures or KGSL driver errors.
# Monitor kernel logs for KGSL/GPU address allocation anomalies
adb shell "dmesg | grep -Ei 'kgsl|gpu|address allocation|deregister'"
# Inspect active GPU memory mappings per process to detect leaks
adb shell "cat /d/kgsl/proc/*/mem | sort -n -k 2"Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2021-1906) exists in the GPU driver kernel module of Qualcomm Snapdragon chipsets. It is caused by improper handling of address deregistration when a specific operation fails within the GPU memory management subsystem. When a failure occurs during memory mapping, the driver fails to release the pre-allocated virtual GPU address space, resulting in a memory leak that prevents subsequent new GPU address allocations.
2. Exploitation Mechanics & Attack Scenario
A local attacker or a malicious application with basic execution privileges can repeatedly request GPU memory mappings and intentionally trigger error paths. Because the vulnerable driver fails to deregister the addresses on failure, the GPU virtual address space becomes completely exhausted over time. Once exhausted, legitimate system processes and user applications are denied GPU resources, causing UI freezing, application crashes, or a full kernel panic.
3. Infrastructure & Business Impact
As this vulnerability is listed in the CISA KEV (Known Exploited Vulnerabilities) catalog, it has been actively exploited in the wild. In enterprise environments, this can lead to operational disruption, especially for critical infrastructure utilizing Snapdragon Industrial IoT or Snapdragon Auto platforms where device availability is paramount.
Official Vendor Advisories & References
Improper handling of address deregistration on failure can lead to new GPU address allocation failure. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Frequently Asked SecOps Questions (CVE-2021-1906)
FAQQ1. How critical is CVE-2021-1906 and is it actively exploited in the wild?
CVE-2021-1906 is rated CVSS 5.5 (MEDIUM) with a 30-day EPSS exploitation probability of 0.5%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2021-1906?
Primary impacted vendors include qualcomm across snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables. Scope summary: All devices utilizing Qualcomm Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice & Music, and Wearables chipsets
Q3. What temporary mitigations or workarounds exist for CVE-2021-1906 before patching?
[Mitigation] Apply the official security patches released by Qualcomm and device OEMs (Samsung, Google, etc.) in or after May 2021 Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2021-1906
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (qualcomm)
View Category →Qualcomm Chipset Memory Corruption Vulnerability via Alignment Miscalculation (CVE-2026-21385) Security Advisory
[Affected Scope] Mobile and embedded devices powered by Qualcomm chipsets running affected Android kernel versions
Apple macOS Screen Sharing Authentication Bypass Vulnerability (CVE-2026-65400)
[Affected Scope] macOS systems running versions prior to Sequoia 15.7.9, Sonoma 14.8.9, Tahoe 26.6.1/26.7, or Golden Gate 27 with Screen Sharing or VNC services enabled
DAEMON Tools Lite Official Installer Supply Chain Attack and Trojanized Binaries (CVE-2026-8398)
[Affected Scope] DAEMON Tools Lite Windows versions 12.5.0.2421 through 12.5.0.2434 distributed between April 8, 2026, and May 5, 2026
Microsoft Windows Shell Command Injection and Security Feature Bypass (CVE-2026-96951) Advisory
[Affected Scope] All supported versions of Windows OS including Windows 10, 11, and Windows Server.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.