CVE-2026-25278

CVE-2026-25278 is a memory corruption flaw in Qualcomm's kernel code that processes I2C transfer requests, caused by a time-of-check/time-of-use race condition (CWE-367) between memory allocation and the subsequent data copy. A local attacker with low privileges can trigger the race, for example by issuing I2C transfer requests in a way that wins the race window, corrupting kernel memory. The impact is local privilege escalation or arbitrary kernel-level read/write/execute effects, reflected in the high confidentiality, integrity, and availability scores in CVSS 3.1 (7.8, local vector, low privileges, no user interaction). It affects devices built on Qualcomm chipsets whose kernels include the affected I2C driver code — a population spanning Android smartphones and other Qualcomm-based products — with the authoritative chipset list published in Qualcomm's security bulletin. There is currently no public proof-of-concept, no CISA KEV listing, and no known exploitation in the wild.

What to do: Monitor Qualcomm's security bulletin for this CVE and apply the fixed kernel/driver through your device vendor's firmware or Android security updates as soon as published. On embedded or Linux products using Qualcomm platforms, update kernel packages and restrict unprivileged access to I2C device nodes (e.g., /dev/i2c-*) as an interim mitigation. Because exploitation requires local low-privileged access, prioritize patching devices that run untrusted third-party apps or local users.