Qualcomm Products Information Disclosure Vulnerability via Weak Hash in IOCTL Session ID Retrieval

A vulnerability exists in various chipsets of Qualcomm products, allowing information disclosure through the return of a weakly hashed value to userland code. This occurs in response to an IOCTL call requesting a session ID, potentially exposing sensitive information.

Impact

Exploitation of this vulnerability leads to unauthorized information disclosure, as a weakly hashed session ID is returned to userland code, which could be intercepted or misused.

Remediation

Qualcomm has notified customers about this vulnerability and is actively sharing patches. Instructions for applying the patch can be found in the January 2026 Qualcomm Security Bulletin.