Qualcomm Adreno GPU KGSL Integer Overflow Memory Corruption Zero-Day (CVE-2026-21385)

Qualcomm Adreno GPU KGSL Integer Overflow Memory Corruption (TL-2026-0179), also tracked as QC-CR#4387106, is a critical-severity zero-day vulnerability scored CVSS 7.8, first published 2026-03-06. It is attributed to Commercial Surveillance Vendor with low confidence, affects Qualcomm Snapdragon 8 Gen 3 Mobile Platform, references 1 CVE (CVE-2026-21385), maps to 18 MITRE ATT&CK techniques (T1003, T1014, T1036), and is covered by 9 detection rules and 15 indicators of compromise.

Key facts for TL-2026-0179

Threat ID
TL-2026-0179
Also known as
QC-CR#4387106, A-478214401
Severity
CRITICAL
CVSS
7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Status
PATCHED
Category
ZERO_DAY
First published
2026-03-06
Last reviewed
2026-03-06
Attribution
Commercial Surveillance Vendor
Attribution confidence
LOW
Motivation
ESPIONAGE
Target sectors
government, defense, telecommunications, technology, media, human-rights, civil-society
Target regions
Global
Detection rules
9
Indicators of compromise
15

Critical integer overflow vulnerability (CWE-190) in Qualcomm's Adreno GPU Kernel Graphics Support Layer (KGSL) driver enables local privilege escalation via memory corruption in the kgsl_memdesc_get_align() function. Affects 235+ Qualcomm chipsets across mobile, automotive, IoT, and connectivity platforms. Actively exploited in targeted attacks consistent with commercial surveillance vendor activity. CISA KEV listed March 3, 2026 with compliance deadline March 24, 2026.

How Qualcomm Adreno GPU KGSL Integer Overflow Memory Corruption works

Qualcomm's Adreno GPU driver contains a critical integer overflow vulnerability in the Kernel Graphics Support Layer (KGSL) component, tracked as CVE-2026-21385. The flaw resides in the kgsl_memdesc_get_align() helper function, which returned a signed integer (int) type. When user-supplied alignment values are processed during GPU memory allocation, the signed return type enables sign extension during bit-shift operations, causing the Memory Management Unit (MMU) to miscalculate the size of memory buffers.

An attacker with local access and low privileges can exploit this by deploying a malicious application that sends specially crafted alignment requests to the graphics driver via ioctl calls. The integer overflow causes the driver to allocate undersized memory buffers while believing larger regions have been reserved. The attacker can then overflow data into adjacent protected kernel memory regions, achieving controlled memory corruption.

The exploit chain proceeds as follows: (1) A malicious local application is deployed on the target device; (2) The app sends crafted alignment values to the KGSL driver through the GPU ioctl interface; (3) The signed-to-unsigned conversion error in kgsl_memdesc_get_align() causes the MMU to miscalculate buffer boundaries; (4) Data overflows from the undersized buffer into protected system memory; (5) The attacker achieves kernel-level privilege escalation; (6) Unauthorized access to private data, messages, camera, and microphone functions is obtained.

Google's Threat Analysis Group (TAG) discovered and reported the vulnerability to Qualcomm on December 18, 2025. Qualcomm notified OEM customers on February 2, 2026. The fix changes the return type of kgsl_memdesc_get_align() from signed int to unsigned u32, preventing sign extension vulnerabilities during bit-shift alignment calculations.

The vulnerability affects over 235 Qualcomm chipsets spanning the entire Snapdragon ecosystem: flagship mobile platforms (Snapdragon 8 Gen 1/2/3, 8 Elite, 888, 865), mid-range and entry-level mobile (Snapdragon 4/6/7 series), FastConnect WiFi/Bluetooth modules (6200-7800), automotive platforms (SA4150P through SA9000P), IoT and robotics platforms (QRB5165), XR/AR headsets, audio codecs (WCD9326-9395), and connectivity chips (WCN3615-7881). All Adreno GPU generations from 5xx through current are impacted.

Google's language that the flaw "may be under limited, targeted exploitation" is the specific phrasing historically associated with commercial surveillance vendor or nation-state activity. A previous Qualcomm KGSL zero-day (CVE-2024-43047) that used identical disclosure language was later attributed to commercial spyware tooling by Amnesty International's Security Lab. The pattern suggests targeted surveillance operations against high-value individuals rather than broad criminal exploitation.

The vulnerability was patched in the March 2026 Android security update at patch level 2026-03-05, which addresses over 129 vulnerabilities across Framework, System, kernel, and third-party components. CISA added CVE-2026-21385 to the Known Exploited Vulnerabilities (KEV) catalog on March 3, 2026, requiring all Federal Civilian Executive Branch (FCEB) agencies to apply remediation by March 24, 2026 under BOD 22-01.

---

**Revalidated on 2026-03-12**

Revalidation confirms CVE-2026-21385 remains under active, targeted exploitation nine days after public disclosure. The Android security patch level 2026-03-05, released on March 5, 2026 as part of Google's largest Android security update in nearly eight years (129 total CVEs), contains the fix for this vulnerability. Google Pixel devices have received OTA updates, but the broader Android OEM ecosystem — Samsung, OnePlus, Xiaomi, and others — faces fragmented patch timelines that leave millions of Qualcomm-powered devices exposed. CISA's KEV compliance deadline of March 24, 2026 is 12 days away, creating urgency for federal agencies under BOD 22-01.

Post-disclosure analysis from multiple security vendors (Malwarebytes, Lookout, Zimperium, SOC Prime, Penligent) has reinforced that the exploitation profile is consistent with commercial surveillance vendor activity. The 'limited, targeted exploitation' language used by Google TAG is the same formulation applied to prior Qualcomm KGSL zero-days that were subsequently attributed to state-backed surveillance operations: CVE-2023-33106 and CVE-2023-33107 were weaponized by commercial spyware vendors Variston and Cy4Gate, while CVE-2024-43047 was exploited by the Serbian Security Information Agency (BIA) using Cellebrite and NoviSpy spyware against journalists, activists, and protestors.

The technical root cause — a signed integer return type in kgsl_memdesc_get_align() causing sign extension during bit-shift operations on user-supplied alignment values — represents a systemic pattern in the KGSL codebase. The Adreno GPU's kernel-level attack surface through /dev/kgsl-3d0 ioctl calls has been repeatedly targeted since at least 2021 (CVE-2021-1905), indicating this driver remains a high-value target for exploit developers. Organizations should treat unpatched Qualcomm Android devices as high-risk assets, enforce MDM compliance checks against patch level 2026-03-05, and monitor for indicators of sideloaded applications attempting GPU ioctl exploitation.

MITRE ATT&CK techniques used in TL-2026-0179

credential-access

T1003 OS Credential Dumping

defense-evasion

T1014 Rootkit; T1036 Masquerading; T1211 Exploitation for Stealth

exfiltration

T1041 Exfiltration Over C2 Channel

collection

T1056 Input Capture; T1113 Screen Capture; T1123 Audio Capture; T1125 Video Capture

discovery

T1057 Process Discovery; T1082 System Information Discovery

privilege-escalation

T1068 Exploitation for Privilege Escalation

command-and-control

T1071 Application Layer Protocol

execution

T1106 Native API; T1204 User Execution

initial-access

T1189 Drive-by Compromise

persistence

T1547 Boot or Logon Autostart Execution

impact

T1565 Data Manipulation

Affected products and versions in Qualcomm Adreno GPU KGSL Integer Overflow Memory Corruption

  • Qualcomm — Snapdragon 8 Gen 3 Mobile Platform
    Vulnerable versions: All versions prior to March 2026 patch
    Fixed in: March 2026 security update
  • Qualcomm — Snapdragon 8 Gen 2 Mobile Platform
    Vulnerable versions: All versions prior to March 2026 patch
    Fixed in: March 2026 security update
  • Qualcomm — Snapdragon 8 Gen 1 Mobile Platform
    Vulnerable versions: All versions prior to March 2026 patch
    Fixed in: March 2026 security update
  • Qualcomm — Snapdragon 8 Elite Mobile Platform
    Vulnerable versions: All versions prior to March 2026 patch
    Fixed in: March 2026 security update
  • Qualcomm — Snapdragon 888/888+ Mobile Platform
    Vulnerable versions: All versions prior to March 2026 patch
    Fixed in: March 2026 security update
  • Qualcomm — Snapdragon 865/870 Mobile Platform
    Vulnerable versions: All versions prior to March 2026 patch
    Fixed in: March 2026 security update
  • Qualcomm — Snapdragon 778G Mobile Platform
    Vulnerable versions: All versions prior to March 2026 patch
    Fixed in: March 2026 security update
  • Qualcomm — FastConnect 6200/6700/6800/6900/7800
    Vulnerable versions: All versions prior to March 2026 patch
    Fixed in: March 2026 security update
  • Qualcomm — SA Automotive Platforms (SA4150P-SA9000P)
    Vulnerable versions: All versions prior to March 2026 patch
    Fixed in: March 2026 security update
  • Qualcomm — QRB5165 Robotics Platform
    Vulnerable versions: All versions prior to March 2026 patch
    Fixed in: March 2026 security update

Remediation for Qualcomm Adreno GPU KGSL Integer Overflow Memory Corruption

Patches

  • Android Security Bulletin March 2026 — patch level 2026-03-05
  • Qualcomm Security Bulletin March 2026 — QC-CR#4387106
  • OEM-specific firmware updates from Samsung, Google, OnePlus, Xiaomi, and other Android OEMs

Immediate actions

  • Apply Android security patch level 2026-03-05 or later to all Qualcomm-based devices
  • Enforce MDM patch compliance policies requiring ASPL >= 2026-03-05
  • Block corporate resource access for non-compliant devices until patched
  • Remove sideloaded APK applications from managed devices
  • Audit devices for unknown or unauthorized applications with GPU access

Workarounds

  • Restrict device enrollment to patch-compliant devices only
  • Disable sideloading via enterprise policy (Settings > Security > Install unknown apps)
  • Isolate unpatched devices from sensitive corporate networks
  • Enable SELinux enforcing mode (default on most Android devices)

Longer-term hardening

  • Deploy mobile threat defense (MTD) solutions with kernel exploit detection
  • Implement application allowlisting on managed Android devices
  • Enable Google Play Protect and verify scanning is active on all fleet devices
  • Monitor for anomalous GPU driver ioctl calls via endpoint telemetry
  • Establish baseline patch compliance SLAs with device OEM vendors

CVEs associated with Qualcomm Adreno GPU KGSL Integer Overflow Memory Corruption

CVE-2026-21385

Weaknesses (CWE) in Qualcomm Adreno GPU KGSL Integer Overflow Memory Corruption

CWE-190

Timeline of Qualcomm Adreno GPU KGSL Integer Overflow Memory Corruption

  • Google Android Security Team / Threat Analysis Group (TAG) reports CVE-2026-21385 to Qualcomm
  • Qualcomm notifies OEM customers about CVE-2026-21385 and provides patch guidance
  • Qualcomm publishes March 2026 Security Bulletin including CVE-2026-21385; Android Security Bulletin published
  • NVD publishes CVE-2026-21385 entry with CVSS 7.8 HIGH score and CWE-190 classification
  • Google confirms limited, targeted exploitation of CVE-2026-21385 in the wild; pattern consistent with commercial surveillance vendor activity
  • CISA adds CVE-2026-21385 to Known Exploited Vulnerabilities catalog; sets March 24, 2026 remediation deadline for FCEB agencies under BOD 22-01
  • NVD entry last modified with updated references and analysis
  • Google Pixel devices begin receiving the March 2026 security update with CVE-2026-21385 fix via OTA [Source: https://source.android.com/docs/security/bulletin/pixel/2026/2026-03-01]
  • Google releases Android security patch level 2026-03-05 containing the fix for CVE-2026-21385 as part of the largest Android security update in nearly eight years (129 total vulnerabilities patched) [Source: https://source.android.com/docs/security/bulletin/2026/2026-03-01]
  • Android security patch level 2026-03-05 released containing fix for CVE-2026-21385 among 129 total vulnerabilities
  • Multiple security vendors (Malwarebytes, Lookout, SOC Prime, Zimperium) publish detailed threat intelligence analyses noting exploitation pattern consistency with commercial surveillance vendor activity and prior Qualcomm KGSL zero-day chains [Source: https://www.malwarebytes.com/blog/news/2026/03/high-severity-qualcomm-bug-hits-android-devices-in-targeted-attacks]
  • Threadlinqs Intelligence revalidation confirms active exploitation status unchanged; CISA KEV compliance deadline (March 24) is 12 days away; OEM patch rollout remains fragmented across Samsung, OnePlus, Xiaomi, and other Android device manufacturers [Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog]
  • CISA KEV compliance deadline for Federal Civilian Executive Branch agencies to apply CVE-2026-21385 remediation
  • As of 2026-05-29, CVE-2026-21385 (Qualcomm Adreno KGSL overflow) remains PATCHED: fixed in the March 2026 Android update (2026-03-05 patch level) and on CISA KEV since Mar 3 with its Mar 24 deadline now passed. Exploitation stayed limited and targeted (surveillance-vendor activity), with no successor or broad campaign reported.

Sources cited for Qualcomm Adreno GPU KGSL Integer Overflow Memory Corruption

Threats related to Qualcomm Adreno GPU KGSL Integer Overflow Memory Corruption

Detection coverage for TL-2026-0179

As of 2026-03-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0179 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats