Qualcomm Adreno GPU KGSL Integer Overflow Memory Corruption Zero-Day (CVE-2026-21385) — Threadlinqs Intelligence
As of 2026-05-30, Qualcomm Adreno GPU KGSL Integer Overflow Memory Corruption Zero-Day (CVE-2026-21385) is a critical-severity zero day threat attributed to Commercial Surveillance Vendor (N/A), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 15 indicators of compromise.
Threat ID: TL-2026-0179 · Severity: CRITICAL · CVSS: 7.8 · Status: PATCHED · Category: ZERO_DAY
Attribution: Commercial Surveillance Vendor · N/A · ESPIONAGE
Critical integer overflow vulnerability (CWE-190) in Qualcomm's Adreno GPU Kernel Graphics Support Layer (KGSL) driver enables local privilege escalation via memory corruption in the
Qualcomm's Adreno GPU driver contains a critical integer overflow vulnerability in the Kernel Graphics Support Layer (KGSL) component, tracked as CVE-2026-21385. The flaw resides in the kgsl_memdesc_get_align() helper function, which returned a signed integer (int) type. When user-supplied alignment values are processed during GPU memory allocation, the signed return type enables sign extension during bit-shift operations, causing the Memory Management Unit (MMU) to miscalculate the size of memory buffers.
An attacker with local access and low privileges can exploit this by deploying a malicious application that sends specially crafted alignment requests to the graphics driver via ioctl calls. The integer overflow causes the driver to allocate undersized memory buffers while believing larger regions have been reserved. The attacker can then overflow data into adjacent protected kernel memory regions, achieving controlled memory corruption.
The exploit chain proceeds as follows: (1) A malicious local application is deployed on the target device; (2) The app sends crafted alignment values to the KGSL driver through the GPU ioctl interface; (3) The signed-to-unsigned conversion error in kgsl_memdesc_get_align() causes the MMU to miscalculate buffer boundaries; (4) Data overflows from the undersized buffer into protected system memory; (5) The attacker achieves kernel-level privilege escalation; (6) Unauthorized access to private data, messages, camera, and microphone functions is obtained.
Google's Threat Analysis Group (TAG) discovered and reported the vulnerability to Qualcomm on December 18, 2025. Qualcomm notified OEM customers on February 2, 2026. The fix changes the return type of kgsl_memdesc_get_align() from signed int to unsigned u32, preventing sign extension vulnerabilities during bit-shift alignment calculations.
The vulnerability affects over 235 Qualcomm chipsets spanning the entire Snapdragon ecosystem: flagship mobile platforms (Snapdragon 8 Gen 1/2/3, 8 Elite, 888, 865), mid-range and entry-level mobile (Snapdragon 4/6/7 series), FastConnect WiFi/Bluetooth modules (6200-7800), automotive platforms (SA4150P through SA9000P), IoT and robotics platforms (QRB5165), XR/AR headsets, audio codecs (WCD9326-9395), and connectivity chips (WCN3615-7881). All Adreno GPU generations from 5xx through current are impacted.
Google's language that the flaw "may be under limited, targeted exploitation" is the specific phrasing historically associated with commercial surveillance vendor or nation-state activity. A previous Qualcomm KGSL zero-day (CVE-2024-43047) that used identical disclosure language was later attributed to commercial spyware tooling by Amnesty International's Security Lab. The pattern suggests targeted surveillance operations against high-value individuals rather than broad criminal exploitation.
The vulnerability was patched in the March 2026 Android security update at patch level 2026-03-05, which addresses over 129 vulnerabilities across Framework, System, kernel, and third-party components. CISA added CVE-2026-21385 to the Known Exploited Vulnerabilities (KEV) catalog on March 3, 2026, requiring all Federal Civilian Executive Branch (FCEB) agencies to apply remediation by March 24, 2026 under BOD 22-01.
---
**Revalidated on 2026-03-12**
Revalidation confirms CVE-2026-21385 remains under active, targeted exploitation nine days after public disclosure. The Android security patch level 2026-03-05, released on March 5, 2026 as part of Google's largest Android security update in nearly eight years (129 total CVEs), contains the fix for this vulnerability. Google Pixel devices have received OTA updates, but the broader Android OEM ecosystem — Samsung, OnePlus, Xiaomi, and others — faces fragmented patch timelines that leave millions of Qualcomm-powered devices exposed. CISA's KEV compliance deadline of March 24, 2026 is 12 days away, creating urgency for federal agencies under BOD 22-01.
Post-disclosure a
Target sectors: government, defense, telecommunications, technology, media, human-rights, civil-society
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 15 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
ZERO_DAY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-21385, T1189, T1106, T1204, T1068, T1211, T1014, T1036, T1003, T1082, T1057