CVE-2021-1906

CVE-2021-1906 is an availability flaw in the GPU component of numerous Qualcomm chipsets: improper handling of address deregistration on failure can cause subsequent new GPU address allocations to fail. A local attacker with low privileges (for example, a malicious or compromised app or process on an Android device) can trigger the failure condition, causing GPU allocation failures that can hang or crash the affected device. The CVSS vector (C:N/I:N/A:H) confirms there is no confidentiality or integrity impact, so the attacker gains denial of service rather than code execution or data theft. It affects firmware for Qualcomm APQ8009, APQ8009W, APQ8017, APQ8053, APQ8064AU, APQ8096AU, AQT1000, AR8031, AR8035, AR8151, CSRA6620, and CSRA6640 across Snapdragon Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music, and Wearables product lines. CISA added the vulnerability to the KEV catalog on 2021-11-03, and it was addressed in Android security updates alongside other Qualcomm and Arm zero-days that Google reported as being used in targeted attacks.

What to do: Install the November 2021 (or later) Android security bulletin and Qualcomm-supplied fixes on affected phones, tablets, and embedded devices, and obtain updated firmware from device/OEM vendors for Snapdragon-based automotive, IoT, and connectivity products. Because the flaw is only exploitable locally with low privileges, exposure requires attacker code already running on the device, so applying vendor updates and checking chipset model (APQ8009/APQ8009W/APQ8017/APQ8053/APQ8064AU/APQ8096AU/AQT1000/AR8031/AR8035/AR8151/CSRA6620/CSRA6640) to confirm applicability are the key actions.