CVE-2026-21370

Executive Summary

CVE-2026-21370 is an unpatched out-of-bounds (OOB) write vulnerability in Qualcomm's Camera Driver, triggered when the input batch size and buffer plane count exceed maximum allowed values, leading to memory corruption and a denial-of-service (DoS) condition. The flaw resides in the camera subsystem's input validation logic and is exploitable by a local attacker with low privileges (CVSS base score: 5.3). No patch is currently available from any tracked source, and no public exploit code or CISA KEV listing exists, though the vulnerability class (CWE-787) is historically weaponized. Affected targets are Android devices and IoT platforms integrating Qualcomm camera hardware and the proprietary camera driver stack.

Technical Analysis

The vulnerability exists in the Qualcomm Camera Driver's handling of user-supplied data structures passed via the camera device node (typically /dev/video* or the vendor-specific camera control interface). The core defect is a missing or insufficient bound check when the driver processes an input batch — a collection of buffer descriptors submitted for a single capture operation — and the associated buffer plane count.

Vulnerability Mechanism:

When a userspace process (e.g., a camera HAL client, or a malicious app) submits an VIDIOC_* ioctl command or a vendor-custom request, the driver performs memory allocation and copying of buffer plane metadata. The affected code path iterates over buffer_plane_count entries, writing each plane's offset and length into a fixed-size array allocated on the kernel heap or stack. If the attacker specifies a batch_size or plane_count value that exceeds the maximum allowed (a compile-time constant such as MAX_PLANES or MAX_BATCH_SIZE, typically 8 or 16), the driver writes beyond the bounds of the destination array.

The OOB write is a classic heap overflow in the kernel context. An attacker can control:

• The number of planes declared (oversized value).
• The size and content of each plane's metadata (offset, length, stride).

This allows the attacker to overwrite adjacent kernel heap objects, corrupting pointers or function pointers. While the immediate effect is often a kernel panic (resulting in DoS), a skilled attacker can groom the heap to achieve arbitrary write primitives — a stepping stone to local privilege escalation (LPE) on the Android device.

Attack Surface:

• Local only: Requires access to the camera device node, which is typically world-readable/writable in Android's cameraserver domain but also accessible to third-party apps with the CAMERA permission.
• Privilege requirement: Low (PR:L) — an unprivileged app or a compromised service can trigger it.
• No user interaction (UI:N): The exploit does not require the victim to click or interact; the malicious app triggers the ioctl directly.

Because the vulnerability is in the kernel driver (not a userspace library), exploitation bypasses SELinux sandboxing if the attacker can reach the device node — which is standard for camera-accessing apps.

Exploitation Scenarios

Scenario 1: Malicious Android App — Local Privilege Escalation

1. Reconnaissance: The attacker develops a benign-looking Android app (e.g., a camera filter app). On a rooted or debuggable device, they enumerate the camera device node (/dev/video0) and confirm the driver version by reading /proc/version or vendor-specific /sys/class/video4linux/ entries. Target devices are those with the vulnerable Qualcomm camera driver (e.g., Snapdragon 8 Gen 1/2/3, 7-series, 6-series).

2. Trigger/Weaponization: The app requests the CAMERA permission, gaining access to the camera service. It then opens the camera device node and issues an ioctl(fd, VIDIOC_S_FMT, ...) followed by a custom vendor ioctl (e.g., QCAMERA_PRIV_MSG_BATCH or MSM_CAM_IOCTL_BATCH_BUF) that accepts the batch configuration. The attacker crafts a struct where:

   • batch_size = 0xFFFFFFFF (or a value > MAX_BATCH, e.g., 1024).
   • plane_count = 0xFFFFFFFF (or > MAX_PLANES, e.g., 32).
   • Each plane entry contains attacker-controlled offset/length fields.

3. Payload/Execution: The driver's validation function validate_batch_config() checks batch_size but fails to validate plane_count against the destination array size. The kernel copies the oversized plane array into a fixed 16-entry buffer, writing beyond the boundary. The attacker pre-fills the kernel heap with a fake object (heap grooming) so the overflow overwrites a neighboring object's function_pointer field. When the driver later calls that pointer, control flow redirects to attacker-controlled kernel code (or a ROP chain using msm_camera kernel symbols).

4. Post-Exploitation: With kernel-level execution, the attacker disables SELinux (setenforce 0), spawns a root shell, and installs a persistent backdoor in /system or /vendor. The backdoor can exfiltrate camera streams, contacts, or GPS data. On a non-rooted device, this is a full LPE chain — the app goes from untrusted_app to kernel context.

Scenario 2: Camera Service Compromise — Lateral Movement

1. Reconnaissance: An attacker who has already compromised the cameraserver process (via a separate browser or media-codec vulnerability) uses this CVE to elevate from cameraserver (uid 1041) to root, leveraging the camera device ioctl interface the service already holds.

2. Trigger: Instead of a new app, the attacker injects a malicious ioctl call into the already-running cameraserver process (via ROP or JOP), reusing the same oversized plane_count parameter.

3. Execution & Impact: OOB write corrupts the camera pipeline's metadata buffer, crashing the device (DoS) or escalating to kernel access. The attacker pivots to dump /data (app databases) and /system secrets.

Impact Assessment

• CVSS 5.3 (Medium): Vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The high availability impact dominates; integrity and confidentiality are not directly compromised but are achievable via post-LPE.
• Affected Systems: All devices running Qualcomm Snapdragon SoCs with camera drivers in the 2022–2026 timeframe — including Android smartphones, automotive infotainment units, and IoT cameras using Qualcomm SoCs. The exact version list is empty in CVE data, indicating incomplete vendor reporting.
• Blast Radius:
  • Confidentiality: No direct data leak, but a successful LPE chain grants full access to all files, camera feeds, and encryption keys.
  • Integrity: Corrupted heap objects can be used to overwrite arbitrary memory, enabling persistent firmware/OS tampering.
  • Availability: The most certain impact — a malformed ioctl reliably triggers a kernel panic, rebooting the device. In enterprise IoT fleets, a single malicious app bricking devices constitutes a distributed DoS.
• Business Impact: For mobile device management (MDM) environments, this is a low-severity individual-device risk but a systemic risk for organizations with bring-your-own-device (BYOD) policies — a malicious employee app can take over a corporate device. For embedded vendors shipping Qualcomm-based cameras, the lack of a patch means a permanent exposure window.

Detection Guidance

Sigma Rule

title: Qualcomm Camera Driver Out-of-Bounds Write (CVE-2026-21370)
id: 4f4a7c9e-2d13-4a85-9c44-6a5a3b44b8a1
status: experimental
description: Detects anomalous ioctl calls to camera device nodes with excessive batch or plane counts.
author: valtersit threat intel team
date: 2026/06/01
tags:
    - attack.t1068
    - attack.privilege_escalation
    - cve.2026-21370
logsource:
    product: linux
    category: audit
detection:
    selection:
        type: 'ioctl'
        syscall:
            - 'ioctl'
        fd:
            - '/dev/video*'
            - '/dev/msm_camera*'
    filter:
        request:
            - 'QCAMERA_PRIV_MSG_BATCH'
            - 'MSM_CAM_IOCTL_BATCH_BUF'
    condition: selection and filter
level: high
falsepositives:
    - Legitimate camera HAL operations if the vendor uses the same ioctl names.
    - Rare but possible on debug builds.

YARA Rule

rule CVE_2026_21370_Qualcomm_Camera_Driver_Batch_Overflow
{
    meta:
        author = "valtersit threat intel team"
        description = "Detects shellcode or payloads crafting oversized camera batch plane structures"
        cve = "CVE-2026-21370"
        date = "2026-06-01"

    strings:
        $ioctl_1 = "QCAMERA_PRIV_MSG_BATCH" ascii wide
        $ioctl_2 = "MSM_CAM_IOCTL_BATCH_BUF" ascii wide
        $ioctl_3 = "VIDIOC_S_FMT" ascii wide
        $gadget = { 48 89 35 ?? ?? ?? ?? 48 89 36 ?? ?? ?? ?? } // mov rsi, [rip+...]; mov [rsi], rsi (heap overflow style)
        $overflow_const = { FF FF FF FF FF FF FF FF } // 0xFFFFFFFF batch_size / plane_count

    condition:
        uint16(0) == 0x5A4D or uint16(0) == 0x457F // PE or ELF any_file
        and any of them
}

Suricata IDS Rule

alert ip any any -> any any (msg:"CVE-2026-21370 Qualcomm Camera Driver Batch Overflow Attempt"; \
    content:"QCAMERA_PRIV_MSG_BATCH"; nocase; \
    content:"|FF FF FF FF|"; distance:0; within:32; \
    classtype:attempted-admin; sid:202621370; rev:1; \
    reference:cve,2026-21370; metadata:created_at 2026-06-01;)

Elastic Detection

sequence with maxspan=5s
[process where event.action == "executed" and
    process.name : ("camera*", "cameraserver", "*hal*") and
    file.path : ("/dev/video*", "/dev/msm_camera*") ]
[ioctl where event.action == "ioctl" and
    syscall.name == "ioctl" and
    system.args : "*BATCH*" and
    system.args : "*FF FF FF FF*"]

Splunk SPL Query

index=linux_audit
| search syscall=ioctl AND fd="/dev/video*" OR "/dev/msm_camera*"
| regex _raw="(QCAMERA_PRIV_MSG_BATCH|MSM_CAM_IOCTL_BATCH_BUF)"
| regex _raw="\xFF\xFF\xFF\xFF|FFFFFFFF"
| stats count, values(comm) as process, values(pid) as pid by host, sourcetype
| where count > 5
| table _time, host, process, pid, count

Wazuh OSSEC Rule

<rule id="100217" level="12">
    <decoded>
        <program_name>kernel</program_name>
        <prematch>general protection fault|BUG: unable to handle kernel paging request|KASAN: out-of-bounds</prematch>
    </decoded>
    <match>camera|msm_camera|vidc|cam</match>
    <description>CVE-2026-21370: Qualcomm Camera Driver out-of-bounds write triggered — potential kernel panic.</description>
    <group>kernel,memory_corruption,</group>
    <info>Exploitation attempt of CVE-2026-21370 detected via kernel fault in camera driver path.</info>
    <mitre><id>T1068</id></mitre>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor fix, advisory, or code commit exists across all tracked sources (GitHub, NVD, Qualcomm security bulletin, Android Security Bulletin).

1. Immediate Mitigations (no patch available):

   • Restrict camera device node access: Deploy SELinux policy to deny untrusted_app domains access to /dev/video* and /dev/msm_camera* unless explicitly required. Use sepolicy rules to add a neverallow for untrusted_app domain on camera device nodes — this is the highest-impact immediate control.
   • Disable camera (if acceptable): For high-security IoT/camera deployments, disable the camera service entirely (pm disable com.android.camera2 or remove the driver module via rmmod).
   • Monitor kernel logs: Ship the Wazuh/Splunk rules above to all endpoints; alert on KASAN: out-of-bounds or general protection fault in the msm_camera path.

2. Patch/Upgrade Steps:

   • No qualified patch exists. Work with your Qualcomm point of contact (if enterprise) to obtain an advance notice of the fix.
   • Monitor Qualcomm Security Bulletin (monthly, second Tuesday) and Android Security Bulletin (monthly, first Monday) for a firmware-level patch.
   • When a patch lands, apply via vendor OTA or enterprise MDM fleet update. Validate the patch with a regression test on a batch-capture workflow.

3. Long-Term Hardening:

   • Enable SELinux enforcing on all devices (many low-cost Android devices ship in permissive mode).
   • Enforce device attestation via Play Integrity API or enterprise equivalents to block compromised devices from accessing corporate resources.
   • Audit third-party camera apps for excessive device-node access; deny CAMERA permission in high-risk profiles.
   • Maintain a firmware update policy that applies Qualcomm patches within 30 days of release.

EPSS Note: With an EPSS score of 0.00060 (0.0% percentile), active exploitation likelihood is currently minimal; however, this will rise once a proof-of-concept appears on exploit-db or GitHub. Re-evaluate prioritization weekly.

References

1. NVD – CVE-2026-21370: https://nvd.nist.gov/vuln/detail/CVE-2026-21370 — Official CVE description and CVSS vector.
2. CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-21370 is NOT listed (status as of 2026-06-01).
3. Qualcomm Security Bulletin: https://www.qualcomm.com/developer/security — Monitor for future vendor patch reference.
4. Android Security Bulletin: https://source.android.com/docs/security/bulletin — Companion bulletin; track for AOSP-level mitigation.
5. Exploit-DB (monitor): https://www.exploit-db.com — No exploit code posted for this CVE as of writing; check for future public PoCs.

Threat Actor Activity: No known threat actor campaigns or exploit-in-the-wild evidence for CVE-2026-21370 as of this report. The unpatched status, combined with the prevalence of Qualcomm Snapdragon in Android, places this on the watchlist for state-sponsored mobile exploit developers (e.g., NSO Group, Intellexa) who frequently target camera driver bugs.