EXPLOIT/ALERT Back to feed

Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability

Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.

Published 7 Oct 2026Updated 7 Oct 2026607 sources
CVSS 0.0 PoC CANDIDATE△ CISA KEV
Overview Sources History

What happened

Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.

Affected versions

Multiple Chipsets: See original advisory Fixed: See vendor advisory.

Why it matters

This source correlation may provide earlier visibility while structured CVE metadata is still being updated.

Detection & mitigation

  • Review the original advisory and validate affected versions.
  • Apply vendor-provided updates or mitigations when available.

Public PoC references

RepositoryAuthorFirst seenReference
PoC-in-GitHub · zhuowei/cheeseCVE-2025-21479 proof-of-concept, I think★ 277zhuowei2025-06-19CandidatePoC-in-GitHub · sarabpal-dev/cheese-cakeA proof-of-concept for CVE-2025-21479, chained with a Dirty Pagetable technique.★ 35sarabpal-dev2025-11-16CandidatePoC-in-GitHub · ma4the/omae-wa-cheese-daCVE-2025-21479 PoC for ZFlip5 with Knox in the way!(˶˃ ᵕ ˂˶)★ 18ma4the2026-06-18CandidatePoC-in-GitHub · CamsShaft/SELinux-Permissive-Only-CVE-2025-21479This is an SELinux permissive version of the Cheese exploit also known as CVE-2025-21479 which affected the adreno kgsl on many devices including Samsung snapdragon devices★ 8CamsShaft2026-07-28CandidatePoC-in-GitHub · reaizuguo/vivo_iqoo_neo_9_root_research_on_CVE-2025-21479iQOO Neo9 (PD2338C) 免解锁 Caps-Root 工具** — 基于 CVE-2025-21479 (Adreno GPU SDS) 的任意物理写提权方案★ 3reaizuguo2026-08-18CandidatePoC-in-GitHub · xianwan1314/cve-2025-21479-iqoo11proCVE-2025-21479 (Qualcomm Adreno GPU) reproduction notes for vivo iQOO 11 Pro (PD2254) - authorized research★ 1xianwan13142026-08-18CandidatePoC-in-GitHub · linux-tools/vivo_iqoo_neo_9_root_research_on_CVE-2025-21479★ 10linux-tools2026-08-19CandidatePoC-in-GitHub · Qingizi7/cve-2025-21479_iqooneo8Local root exploit for CVE-2025-21479 (Adreno KGSL) on iQOO Neo8 (SM8475) - physical memory r/w, disables SELinux, spawns root shell★ 6Qingizi72026-08-20CandidatePoC-in-GitHub · xjoker/lenovo_y700_tb320fc_on_CVE-2025-21479★ 0xjoker2026-09-16CandidatePoC-in-GitHub · RamenFast/zenfone9-rootTemporary root (uid 0) on a bootloader-locked ASUS Zenfone 9 via CVE-2025-21479 + a perf-based physical-address leak. GPLv3.★ 4RamenFast2026-09-17CandidatePoC-in-GitHub · diyiqiuye/CVE-2025-21479-FX5PTemporary root for OPPO Find X5 Pro (PFEM00) via CVE-2025-21479 + KernelSU LKM late-load (cloud-buildable)★ 2diyiqiuye2026-09-24CandidatePoC-in-GitHub · longg66/cve-2025-21479_iqooneo7speedCVE-2025-21479 (Qualcomm Adreno GPU) local privilege escalation on vivo iQOO Neo7 竞速版 / PD2232 (SM8475, Adreno 730, GKI 5.10). No bootloader unlock, no flashing. Includes adapted exploit source, prebuilt binaries, compatibility precheck, and KernelSU/ReSukiSU late-load persistence. Verified on kernel 5.10.233-gki, vendor patch 2025-03-05.★ 0longg662026-10-02CandidatePoC-in-GitHub · linux-tools/VIVO-IQOO-Neo9-Root-ToolsSupport OriginOS 4~ OriginOS 6(Some firmware requires manual, individual adaptation), using CVE-2025-21479，CVE-2026-43499★ 5linux-tools2026-10-06CandidatePoC-in-GitHub · Shiho-Patch/linux-tools-vivo_iqoo_neo_9_root_research_on_CVE-2025-21479★ 0Shiho-Patch2026-10-06CandidatePoC-in-GitHub · Type010/cheese-appCVE-2025-21479 one click root★ 0Type0102026-10-08Candidate
CorrectionsReport an issue