CVE-2026-25260: Time-of-check Time-of-use (TOCTOU) Race Condition in DSP Service

Synopsis

A time-of-check time-of-use (TOCTOU) race condition affects the Qualcomm Snapdragon DSP service across several chipsets including Cologne, FastConnect 6900, FastConnect 7800, and QCA0000. The vulnerability is reachable locally by a low-privilege attacker without any network access or victim interaction, exploiting a window where shared buffers are accessed before concurrent user-mode modifications are validated. Successful exploitation causes memory corruption that gives the attacker full read access, write access, and the ability to crash the affected service. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to trigger the race condition; no administrative rights are needed.

• Victim interactionNot required

  No action from another user or administrator is required to exploit this vulnerability.

• Attack complexityDetail

  The exploit is rated low complexity, meaning it does not depend on specific memory layouts, race-window timing margins, or other unreliable environmental factors beyond the attacker's control.

Blast Radius

• Reads arbitrary memory regions accessible to the DSP service, including buffers that may contain sensitive application data or credentials.
• Writes to shared memory buffers, allowing an attacker to tamper with data being processed by the DSP service or higher-privilege components that consume its output.
• Crashes the DSP service, disrupting audio, sensor, and compute offload functionality that depends on it.
• Privilege escalation to a higher context is possible if corrupted memory overlaps with security-sensitive kernel or firmware data structures.