CVE-2021-1906 Qualcomm Multiple Chipsets Detection of Error Condition Without Action

Exploited in the wild Medium 6.2 Published 7 May 2021 Updated 21 Oct 2025

Improper GPU address deregistration handling can cause allocation failures, leading to denial of service on Qualcomm Snapdragon devices.

Exploited in the wild: Since 3 Nov 2021
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2021-1906?

CVE-2021-1906 is a medium-severity denial of service vulnerability in Qualcomm Apq8009 Firmware, published on 7 May 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Improper handling of address deregistration on failure can lead to new GPU address allocation failure. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Which versions are affected by CVE-2021-1906?

It affects 400 products.

Products include Qualcomm Apq8009 Firmware, Qualcomm Apq8009w Firmware, Qualcomm Apq8017 Firmware, Qualcomm Apq8053 Firmware, Qualcomm Apq8064au Firmware, Qualcomm Apq8096au Firmware and 394 more.

How do I fix CVE-2021-1906?

Apply the vendor's patch. US federal agencies must fix it by 17 Nov 2021.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-1906 being exploited?

Yes. Attackers have exploited CVE-2021-1906 in the wild since at least 3 Nov 2021.

All Qualcomm Apq8009 Firmware vulnerabilities

Sources

Also known as 2835082, A-178810049, ASB-A-178810049, GHSA-xjgh-8jrf-3xgw.