CVE-2026-21384

Executive Summary

CVE-2026-21384 is an out-of-bounds write vulnerability in the Qualcomm Camera Driver, triggered when the driver updates prepared commands with invalid port indices supplied from user space, exceeding supported read client limits. An attacker with local access and low privileges can exploit this flaw to achieve arbitrary memory corruption within the kernel context of the camera subsystem, leading to full confidentiality, integrity, and availability compromise. The vulnerability is currently unpatched, with no vendor fix or verified workaround available; however, the EPSS score of 0.00056 indicates a low probability of active exploitation in the wild at this time.

Technical Analysis

The vulnerability resides in the Qualcomm Camera Driver, a kernel-mode component responsible for managing camera sensor interfaces, ISP pipelines, and memory buffers between user-space clients and the camera hardware. The flaw is classified as an out-of-bounds write (CWE-787), occurring specifically during the "update prepared commands" operation.

From a code-level perspective, the camera driver exposes a set of IOCTL handlers to user-space processes. Within the command update path, the driver validates port indices that reference client read channels. The NVD description states that the validation fails when the user-space-supplied port index exceeds the supported read client limits. When an invalid index is provided, the driver performs a write operation relative to an array or table of client contexts without properly bounds-checking the index value. This results in a memory corruption condition where an attacker-controlled index can cause the driver to write data (such as command structures, buffer addresses, or flags) to an address outside the intended array bounds.

The attack surface is the camera driver's IOCTL interface exposed to user space. Since Android devices with Qualcomm SoCs commonly expose camera functionality through a Binder service and associated character devices (e.g., /dev/video, /dev/media), a malicious or compromised application with device access permissions can invoke the affected operation. The CVSS vector confirms a local attack vector (AV:L), low attack complexity (AC:L), and low privileges required (PR:L) — meaning an attacker only needs a standard unprivileged Android or Linux application context to trigger the flaw.

The root cause is a missing or incomplete bounds check on the port index parameter during the command preparation stage. The driver likely maintains an array of read client structures, and the update function iterates or writes based on an index that should be constrained to the number of configured clients. The NVD description indicates the index can exceed this supported count, leading to a heap or stack out-of-bounds write depending on where the client array resides.

Given the CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, the vulnerability requires local access but no user interaction. The scope is unchanged (S:U), meaning the compromised component is isolated to the camera driver context. However, because the camera driver runs in kernel space, a successful exploit can lead to privilege escalation from an unprivileged user-space process to arbitrary kernel code execution.

Exploitation Scenarios

The following attack chain describes how an attacker would exploit CVE-2026-21384 in a real-world scenario:

Step 1 — Reconnaissance and Target Identification: An attacker targets an Android device or Linux system running a Qualcomm SoC with a camera subsystem. Footprinting includes identifying the kernel version, camera driver module (e.g., qcom-camera, msm_camera), and the file paths of exposed camera device nodes (/dev/video*, /dev/media*, /dev/cam_smem*). On a targeted device, the attacker may use standard filesystem enumeration (ls -la /dev/video*), reading kernel logs (dmesg), or querying the camera HAL service through Binder to confirm the driver is present and readable.

Step 2 — Trigger/Weaponization: The attacker opens the camera device node with standard open() syscall and issues an IOCTL to initiate the command preparation flow. Specifically, the attacker crafts an ioctl request that targets the "update prepared commands" code path. The exploit payload includes a crafted data structure where the port index field is set to a value exceeding the supported read client limit. For example, if the driver supports up to 8 read clients, the attacker sets the index to 0x1000 or another large value. The weaponization step requires minimal reverse engineering — the attacker determines the IOCTL number and structure layout through disassembly of the camera HAL library or kernel driver (if available from device firmware dumps).

Step 3 — Payload/Execution: Upon receiving the malicious IOCTL, the camera driver enters the update function. The driver retrieves the attacker-supplied port index and, lacking proper bounds validation, uses it to index into an internal array of prepared command structures. The driver then writes a portion of the command metadata (e.g., buffer pointers, length fields, or flags) to the address computed as base_array + (index * sizeof(client_struct)). Since the index is attacker-controlled and out of bounds, the write lands in an adjacent kernel heap allocation or a predictable offset from the array base. The attacker uses this primitive to overwrite a function pointer, a credential structure, or a similar sensitive kernel object. For privilege escalation, the attacker overwrites a /proc or /sys entry's write handler or a task's cred structure to elevate to root, then executes arbitrary code from kernel context.

Step 4 — Post-Exploitation Impact: With root or kernel-level code execution, the attacker achieves full device compromise. This includes reading camera sensor data, exfiltrating sensitive information from kernel memory (e.g., other processes' memory, encryption keys), installing persistent backdoors in the boot chain, or disabling security mechanisms. On shared enterprise Android devices (e.g., COPE/COBO deployments), this compromises the entire device and any connected corporate resources. The confidentiality impact (C:H) enables arbitrary data reads; integrity impact (I:H) allows tampering with system state; availability impact (A:H) permits denial-of-service via kernel panic.

Impact Assessment

Business Impact: CVE-2026-21384 represents a high-severity privilege escalation flaw in a critical mobile platform component. For enterprises deploying Android endpoints, a successful exploit grants an attacker kernel-level control of the device. This translates to full data theft (emails, credentials, corporate documents, camera imagery), device-level persistence, and the ability to pivot to other corporate systems via VPN or remote access sessions. The camera subsystem's memory is also shared with media processing pipelines, potentially exposing sensitive visual data.

Affected Systems: Any Android device or Linux-based system using a Qualcomm SoC with the affected camera driver is vulnerable. This includes smartphones, tablets, IoT devices, and automotive infotainment systems. The lack of disclosed affected version ranges means all currently shipped Qualcomm camera driver versions are presumed vulnerable until patched.

Blast Radius: The CVSS subscores indicate full impact across all three security objectives: C:H/I:H/A:H. The attack complexity is low (AC:L) and requires only low privileges (PR:L), meaning any installed application (including third-party apps) can trigger the flaw. The scope is unchanged (S:U), so the compromised component (camera driver/kernel) is the sole victim; however, in kernel context, the attacker can target any process or data on the device. The local attack vector (AV:L) limits remote exploitation, but combined with a secondary vector (e.g., malicious app distribution, browser exploit chain), the practical risk is high.

CISA KEV: Not listed in CISA's Known Exploited Vulnerabilities catalog, and the EPSS score (0.00056) places it in the 0th percentile for exploitation probability.

Detection Guidance

Detection of this vulnerability is challenging due to its local nature and absence of network-observable artifacts. The following rules focus on host-based detection of anomalous camera driver IOCTL calls, out-of-bounds memory access patterns, and the post-exploitation kernel activity.

Sigma Rule

title: Qualcomm Camera Driver Out-of-Bounds Write - CVE-2026-21384
id: 3f3d7c2e-9b1a-4e5f-8c2d-1a2b3c4d5e6f
status: experimental
description: Detects anomalous IOCTL calls to Qualcomm camera device nodes with excessive port indices or unexpected command update patterns.
author: Valtersit Threat Intelligence
date: 2026/01/15
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith:
            - '/camera_service'
            - '/cameraserver'
            - '/vendor/bin/mm-qcamera-daemon'
        CommandLine|contains:
            - 'ioctl'
            - '/dev/video'
            - '/dev/media'
        # Heuristic: process invoking ioctl on camera devices
        ProcessId|integer: '*'
    condition: selection
    level: medium
    tags:
        - attack.privilege_escalation
        - attack.t1068
        - cve.2026.21384

YARA Rule

rule CVE_2026_21384_Camera_Driver_Ioctl
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detect exploit payloads targeting Qualcomm Camera Driver out-of-bounds write"
        cve = "CVE-2026-21384"
        date = "2026-01-15"
    strings:
        $ioctl = "/dev/video" ascii
        $ioctl2 = "/dev/media" ascii
        $cmd_update = "UPDATE_PREPARED_COMMAND" ascii
        $port_idx = { 64 00 00 00 }  // base64 encoded port index large value
        $camera_drv = "qcom-camera" ascii
    condition:
        (uint16(0) == 0x5A4D or uint16(0) == 0x7F45) and
        (1 of ($ioctl*) or 1 of ($ioctl2*)) and
        (1 of ($cmd_update*) or 1 of ($port_idx*))
}

Suricata IDS Rule

alert ip any any -> any any (msg:"CVE-2026-21384 - Qualcomm Camera Driver OOB Write Attempt"; content:"/dev/video"; sid:20260001; rev:1; classtype:attempted-admin; reference:cve,2026-21384; metadata:created_at 2026_01_15, updated_at 2026_01_15;)

Note: This vulnerability operates locally via IOCTL, not over a network. This rule is limited to detecting download attempts of exploit payloads or command-and-control traffic containing exploit strings. For host-based detection, rely on the Sigma rule and Elastic EQL query.

Elastic Detection

sequence by process.entity_id with maxspan=1m
  [ process where event.type == "start" and
      process.name in ("cameraserver", "mm-qcamera-daemon") ]
  [ syscall where event.action == "ioctl" and
      syscall.arg.path == "/dev/video0" or
      syscall.arg.path == "/dev/media0" ]

Splunk SPL Query

index=linux sourcetype=linux:audit
| where process_name IN ("cameraserver", "mm-qcamera-daemon")
| search syscall=ioctl
| search arg_value IN ("/dev/video*", "/dev/media*")
| stats count by host, user, process_name, arg_value
| where count > 10

Wazuh OSSEC Rule

<rule id="100213" level="10">
    <if_sid>510</if_sid>
    <regex>ioctl</regex>
    <description>CVE-2026-21384: Anomalous ioctl to Qualcomm camera device node</description>
    <group>cve_2026_21384,privilege_escalation,</group>
    <mitre>
        <id>T1068</id>
    </mitre>
</rule>

<rule id="100214" level="12">
    <if_sid>100213</if_sid>
    <regex>UPDATE_PREPARED_COMMAND</regex>
    <description>CVE-2026-21384: Malicious command update pattern to camera driver detected</description>
    <group>cve_2026_21384,privilege_escalation,</group>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source. The vendor has not released a fix, and no affected version ranges have been disclosed.

Immediate Mitigations (until patch available):

1. Restrict Camera Device Access: Implement SELinux policies or use file permission controls to limit access to camera device nodes (/dev/video*, /dev/media*) to only the privileged camera HAL service and system_app contexts. Block third-party applications from directly invoking IOCTLs on these nodes.
2. Application Whitelisting: Deploy application whitelisting on managed devices to prevent installation of untrusted applications that may leverage the camera driver interface.
3. Monitor Kernel Logs: Enable and monitor dmesg output for camera driver errors, particularly messages indicating "invalid port index" or "out of bounds" before the system panics.
4. Disable Unused Camera Features: On devices where camera functionality is not business-critical, disable the camera HAL service or the kernel module entirely via system config or module blacklist (/etc/modprobe.d/).

Patch/Upgrade Steps:

• Monitor Qualcomm Security Bulletin and Android Security Bulletin for CVE-2026-21384 patches. Once a fix is released, apply the vendor OTA update immediately.
• For enterprises controlling the Android image, track the Android Open Source Project (AOSP) for a kernel patch that adds bounds validation to the port index in the camera driver's update command function.

Long-Term Hardening:

1. Kernel Hardening: Enable kernel hardening mitigations (e.g., PAN/XN, KASLR, heap freelist randomization) to increase exploitation difficulty even if the bug is triggered.
2. Driver Code Audit: Periodically audit vendor-supplied kernel drivers, particularly camera/sensor drivers, which are historically rich in memory-corruption bugs due to complex user-space interaction.
3. Update Management: Maintain a strict update cadence for Android security patches. Use enterprise mobile device management (MDM) to enforce patch compliance.
4. Threat Monitoring: Integrate the detection rules above into host-based monitoring to identify exploitation attempts promptly.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-21384
2. Qualcomm Security Bulletin: https://www.qualcomm.com/company/product-security/bulletins (monitor for future advisories referencing CVE-2026-21384)
3. MITRE ATT&CK Tactic Reference: https://attack.mitre.org/techniques/T1068/
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE not listed — status confirmed)
5. CWE-787 Reference (Out-of-bounds Write): https://cwe.mitre.org/data/definitions/787.html

Threat Actor Campaigns: No known threat actor campaigns or exploit-in-the-wild evidence for CVE-2026-21384 at the time of writing. The EPSS score of 0.00056 confirms minimal observed exploitation activity. However, the existence of a public PoC reference increases the risk of future weaponization once the technical details are analyzed by the broader security community.