The flaw originates when multiple threads send IOCTL requests concurrently to a Qualcomm Snapdragon IPC device control handler that lacks proper synchronization. The race condition permits one thread to read beyond the bounds of a kernel buffer, resulting in a buffer over‑read. Because the driver operates in kernel space, the over‑read can expose adjacent kernel memory or trigger a crash, weakening system confidentiality or availability.

Qualcomm Snapdragon processors run a native IPC driver that contains the vulnerable synchronization logic. No specific firmware or kernel version is disclosed in the advisory, so every Snapdragon device that includes the current IPC driver should be considered at risk until an official fix is released.

The vulnerability is scored CVSS 7.8, indicating high severity, but its EPSS score is below 1 %, suggesting a low probability of exploitation. The flaw is not listed in CISA KEV. An attacker would need to issue multiple concurrent IOCTLs to the IPC device, a capability that typically requires local access or elevated privileges. Thus the primary attack vector is local, and remote exploitation would be difficult without prior compromise.