Qualcomm Camera Driver TOCTOU Race Condition Vulnerability Allowing Memory Corruption

A time-of-check time-of-use (TOCTOU) race condition vulnerability has been identified in the Qualcomm Camera Driver. This vulnerability allows memory corruption to occur when a blob structure is altered by user-space after it has been verified by the kernel. The issue arises from improper synchronization, enabling user-space modifications to interfere with kernel-level processing, potentially leading to arbitrary memory changes or corruption.

Impact

Exploitation of this vulnerability causes memory corruption, which can lead to undefined behavior such as application crashes, memory leaks, or the execution of arbitrary code.

Remediation

Qualcomm has released patches for this vulnerability. Instructions for applying the patch can be found in the Qualcomm May 2025 Security Bulletin.