{"id":"CVE-2021-1906","kind":"vulnerability","aliases":["CVE-2021-1906"],"related":[],"title":"Qualcomm Multiple Chipsets: Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability","description":"Improper handling of address deregistration on failure can lead to new GPU address allocation failure. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables","summary":"Qualcomm chipsets have a flaw where failed GPU address deregistration is not handled, so a later GPU address allocation can fail. The sources say it is exploited in the wild, but do not state what an attacker gets beyond that.","severity":"medium","cvss":6.2,"epss":0.0052,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Qualcomm Multiple Chipsets","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","exploited","mobile-devices","qualcomm","vendor"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the firmware and driver updates from the device vendor per the CISA required action; specific patched versions are unknown from the sources.","status":"open","published_at":"2021-05-07T09:15:08+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:41:38+00:00","updated_at":"2026-10-23T21:57:34+00:00","category":"vendor","confidence":0.4,"triage":{"at":"2026-10-23T21:41:38Z","model":"claude-haiku-5-5","output":{"fix":"Apply the firmware and driver updates from the device vendor per the CISA required action; specific patched versions are unknown from the sources.","reach":"unknown","impact":"medium","summary":"Qualcomm chipsets have a flaw where failed GPU address deregistration is not handled, so a later GPU address allocation can fail. The sources say it is exploited in the wild, but do not state what an attacker gets beyond that.","category":"vendor","who_cares":["qualcomm","android","mobile-devices"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; sources do not state the attacker gain","analyst_note":"Find the affected chipset list and patched driver or security bulletin versions from the Qualcomm security bulletin for CVE-2021-1906, and confirm the attacker gain from the CISA KEV entry or NVD.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000471,"input_tokens":2863,"output_tokens":369,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find the affected chipset list and patched driver or security bulletin versions from the Qualcomm security bulletin for CVE-2021-1906, and confirm the attacker gain from the CISA KEV entry or NVD.","search":"'-1906':16A,19A '-2021':15A,18A 'action':12A 'address':38B,47B,72C,81C 'alloc':48B,82C 'android':23B 'attack':66B 'auto':86C 'beyond':68B 'chipset':3A,6A,31B 'chipsets':22A 'comput':88C 'condit':10A 'connect':90C 'consum':92C 'cve':14A,17A 'deregistr':39B,73C 'detect':7A 'devic':27B 'error':9A 'exploit':24B,56B 'fail':36B,50B 'failur':75C,83C 'flaw':34B 'get':67B 'gpu':37B,46B,80C 'handl':42B,70C 'improp':69C 'industri':95C 'iot':93C,96C 'later':45B 'lead':77C 'mobil':26B,98C 'mobile-devic':25B 'multipl':2A,5A 'multiple':21A 'music':101C 'new':79C 'qualcomm':1A,4A,20A,28B,30B 'say':53B 'snapdragon':85C,87C,89C,91C,94C,97C,99C,102C 'sourc':52B 'state':63B 'vendor':29B 'voic':100C 'vulner':13A 'wearabl':103C 'wild':59B 'without':11A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-05-07T09:15:08+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"product-security@qualcomm.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-1906","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-1906","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T15:39:44+00:00","note":null},{"source":"epss","external_id":"CVE-2021-1906","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-1906","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-1906","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-1906","severity":null,"published_at":"2021-05-07T09:15:08+00:00","modified_at":"2026-06-17T03:32:48+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T21:57:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}