# Qualcomm Adreno GPU KGSL Integer Overflow Memory Corruption Zero-Day (CVE-2026-21385)

> Critical integer overflow vulnerability (CWE-190) in Qualcomm's Adreno GPU Kernel Graphics Support Layer (KGSL) driver enables local privilege escalation via memory corruption in the kgsl_memdesc_get_align() function. Affects 235+ Qualcomm chipsets across mobile, automotive, IoT, and connectivity platforms. Actively exploited in targeted attacks consistent with commercial surveillance vendor activity. CISA KEV listed March 3, 2026 with compliance deadline March 24, 2026.

- **Published:** 2026-03-06T12:00:00Z
- **Last reviewed:** 2026-03-06T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0179
- **ID:** TL-2026-0179
- **Severity:** CRITICAL (CVSS 7.8)
- **Category:** ZERO_DAY
- **Status:** PATCHED
- **Actor:** Commercial Surveillance Vendor
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-21385

## Description

Qualcomm's Adreno GPU driver contains a critical integer overflow vulnerability in the Kernel Graphics Support Layer (KGSL) component, tracked as CVE-2026-21385. The flaw resides in the kgsl_memdesc_get_align() helper function, which returned a signed integer (int) type. When user-supplied alignment values are processed during GPU memory allocation, the signed return type enables sign extension during bit-shift operations, causing the Memory Management Unit (MMU) to miscalculate the size of memory buffers.

An attacker with local access and low privileges can exploit this by deploying a malicious application that sends specially crafted alignment requests to the graphics driver via ioctl calls. The integer overflow causes the driver to allocate undersized memory buffers while believing larger regions have been reserved. The attacker can then overflow data into adjacent protected kernel memory regions, achieving controlled memory corruption.

The exploit chain proceeds as follows: (1) A malicious local application is deployed on the target device; (2) The app sends crafted alignment values to the KGSL driver through the GPU ioctl interface; (3) The signed-to-unsigned conversion error in kgsl_memdesc_get_align() causes the MMU to miscalculate buffer boundaries; (4) Data overflows from the undersized buffer into protected system memory; (5) The attacker achieves kernel-level privilege escalation; (6) Unauthorized access to private data, messages, camera, and microphone functions is obtained.

Google's Threat Analysis Group (TAG) discovered and reported the vulnerability to Qualcomm on December 18, 2025. Qualcomm notified OEM customers on February 2, 2026. The fix changes the return type of kgsl_memdesc_get_align() from signed int to unsigned u32, preventing sign extension vulnerabilities during bit-shift alignment calculations.

The vulnerability affects over 235 Qualcomm chipsets spanning the entire Snapdragon ecosystem: flagship mobile platforms (Snapdragon 8 Gen 1/2/3, 8 Elite, 888, 865), mid-range and entry-level mobile (Snapdragon 4/6/7 series), FastConnect WiFi/Bluetooth modules (6200-7800), automotive platforms (SA4150P through SA9000P), IoT and robotics platforms (QRB5165), XR/AR headsets, audio codecs (WCD9326-9395), and connectivity chips (WCN3615-7881). All Adreno GPU generations from 5xx through current are impacted.

Google's language that the flaw "may be under limited, targeted exploitation" is the specific phrasing historically associated with commercial surveillance vendor or nation-state activity. A previous Qualcomm KGSL zero-day (CVE-2024-43047) that used identical disclosure language was later attributed to commercial spyware tooling by Amnesty International's Security Lab. The pattern suggests targeted surveillance operations against high-value individuals rather than broad criminal exploitation.

The vulnerability was patched in the March 2026 Android security update at patch level 2026-03-05, which addresses over 129 vulnerabilities across Framework, System, kernel, and third-party components. CISA added CVE-2026-21385 to the Known Exploited Vulnerabilities (KEV) catalog on March 3, 2026, requiring all Federal Civilian Executive Branch (FCEB) agencies to apply remediation by March 24, 2026 under BOD 22-01.

---

**Revalidated on 2026-03-12**

Revalidation confirms CVE-2026-21385 remains under active, targeted exploitation nine days after public disclosure. The Android security patch level 2026-03-05, released on March 5, 2026 as part of Google's largest Android security update in nearly eight years (129 total CVEs), contains the fix for this vulnerability. Google Pixel devices have received OTA updates, but the broader Android OEM ecosystem — Samsung, OnePlus, Xiaomi, and others — faces fragmented patch timelines that leave millions of Qualcomm-powered devices exposed. CISA's KEV compliance deadline of March 24, 2026 is 12 days away, creating urgency for federal agencies under BOD 22-01.

Post-disclosure analysis from multiple security vendors (Malwarebytes, Lookout, Zimperium, SOC Prime, Penligent) has reinforced that the exploitation profile is consistent with commercial surveillance vendor activity. The 'limited, targeted exploitation' language used by Google TAG is the same formulation applied to prior Qualcomm KGSL zero-days that were subsequently attributed to state-backed surveillance operations: CVE-2023-33106 and CVE-2023-33107 were weaponized by commercial spyware vendors Variston and Cy4Gate, while CVE-2024-43047 was exploited by the Serbian Security Information Agency (BIA) using Cellebrite and NoviSpy spyware against journalists, activists, and protestors.

The technical root cause — a signed integer return type in kgsl_memdesc_get_align() causing sign extension during bit-shift operations on user-supplied alignment values — represents a systemic pattern in the KGSL codebase. The Adreno GPU's kernel-level attack surface through /dev/kgsl-3d0 ioctl calls has been repeatedly targeted since at least 2021 (CVE-2021-1905), indicating this driver remains a high-value target for exploit developers. Organizations should treat unpatched Qualcomm Android devices as high-risk assets, enforce MDM compliance checks against patch level 2026-03-05, and monitor for indicators of sideloaded applications attempting GPU ioctl exploitation.

## MITRE ATT&CK

- T1189 Drive-by Compromise
- T1106 Native API
- T1204 User Execution
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1014 Rootkit
- T1036 Masquerading
- T1003 OS Credential Dumping
- T1082 System Information Discovery
- T1057 Process Discovery
- T1123 Audio Capture
- T1125 Video Capture
- T1056 Input Capture
- T1113 Screen Capture
- T1041 Exfiltration Over C2 Channel
- T1071 Application Layer Protocol
- T1547 Boot or Logon Autostart Execution
- T1565 Data Manipulation

## Sources

- [CISA Adds Two Known Exploited Vulnerabilities to Catalog (March 3, 2026)](https://www.cisa.gov/news-events/alerts/2026/03/03/cisa-adds-two-known-exploited-vulnerabilities-catalog)
- [NVD - CVE-2026-21385](https://nvd.nist.gov/vuln/detail/CVE-2026-21385)
- [Android Security Bulletin — March 2026](https://source.android.com/docs/security/bulletin/2026/2026-03-01)
- [Qualcomm Security Bulletin — March 2026](https://www.qualcomm.com/company/product-security/bulletins/march-2026-bulletin)
- [Google Confirms CVE-2026-21385 in Qualcomm Android Component Exploited](https://thehackernews.com/2026/03/google-confirms-cve-2026-21385-in.html)
- [Qualcomm Zero-Day Exploited in Targeted Android Attacks](https://www.darkreading.com/threat-intelligence/qualcomm-zero-day-exploited-targeted-android-attacks)
- [Android Update Patches Exploited Qualcomm Zero-Day](https://www.securityweek.com/android-update-patches-exploited-qualcomm-zero-day/)
- [CISA Warns Qualcomm Chipsets Memory Corruption Vulnerability Is Actively Exploited](https://gbhackers.com/cisa-warns-qualcomm-chipsets-memory-corruption-vulnerability/)
- [Google Patches Actively Exploited Qualcomm GPU Zero-Day on Android](https://cyberinsider.com/google-patches-actively-exploited-qualcomm-gpu-zero-day-on-android/)
- [Android Devices Hit by Exploited Qualcomm Flaw CVE-2026-21385](https://securityaffairs.com/188823/security/android-devices-hit-by-exploited-qualcomm-flaw-cve-2026-21385.html)
- [High-Severity Qualcomm Bug Hits Android Devices in Targeted Attacks](https://www.malwarebytes.com/blog/news/2026/03/high-severity-qualcomm-bug-hits-android-devices-in-targeted-attacks)
- [Google Addresses Actively Exploited Qualcomm Zero-Day in 129 Android Vulnerabilities](https://cyberscoop.com/android-security-update-march-2026/)
- [Lookout Threat Intel - CVE-2026-21385](https://security.lookout.com/threat-intelligence/article/cve-2026-21385)
- [CVE-2026-21385: Google Patches Qualcomm Zero-Day Exploited in Targeted Android Attacks (SOC Prime)](https://socprime.com/blog/cve-2026-21386-vulnerability/)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0179