Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Evidence dossier
CVE-2022-22071
CVE-2022-22071
gen-56ccdaf9Normalized restatement
Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
- State
- PUBLISHED
- Published
- Jun 14, 2022
- Updated
- Oct 21, 2025
- Evidence coverage
- 72%
2026-07-18 · v2026.06.15 · percentile 36.4%
Distinct CVSS assessments remain side by side; none are averaged.
Source comparison
Who said what
Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
Qualcomm Multiple Chipsets Use-After-Free Vulnerability
Probability 0.004500000000; percentile 0.363510000000
Applicability
Cited product scope
[{"status": "affected"}]unknowncpe:2.3:h:qualcomm:apq8053:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:ar8031:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:ar8035:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:csra6620:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:csra6640:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:mdm9150:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:msm8953:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:qca6174a:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:qca6390:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:qca6391:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:qca6426:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:qca6436:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:qca6574:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:qca6574a:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:qca6574au:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:qca6595au:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:qca6696:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:qca8081:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:qca8337:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:qca9377:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:qcm2290:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:qcm4290:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:qcm6490:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:qcs2290:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:qcs405:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:qcs410:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:qcs4290:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:qcs610:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:qcs6490:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:qrb5165:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:qrb5165m:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:qrb5165n:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:qualcomm215:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:sa6155p:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:sa8155p:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:sa8195p:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:sd439:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:sd460:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:sd480:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:sd662:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:sd680:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:sd690_5g:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:sd695:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:sd750g:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:sd765:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:sd765g:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:sd768g:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:sd778g:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:sd780g:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:sd855:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:sd865_5g:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:sd870:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:sd888_5g:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:sdx12:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:sdx55:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:sdx55m:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:sdx65:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:sdxr2_5g:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:sm4125:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:sm7250p:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:sm7325p:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:wcd9326:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:wcd9335:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:wcd9341:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:wcd9370:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:wcd9375:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:wcd9380:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:wcd9385:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:wcn3615:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:wcn3660b:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:wcn3680b:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:wcn3910:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:wcn3950:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:wcn3980:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:wcn3988:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:wcn3991:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:wcn3998:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:wcn3999:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:wcn6740:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:wcn6750:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:wcn6850:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:wcn6851:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:wcn6855:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:wcn6856:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:wcn7850:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:wcn7851:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:wsa8810:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:wsa8815:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:wsa8830:-:*:*:*:*:*:*:*constrainedcpe:2.3:h:qualcomm:wsa8835:-:*:*:*:*:*:*:*constrainedcpe:2.3:o:qualcomm:apq8053_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:ar8031_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:ar8035_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:csra6620_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:csra6640_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:mdm9150_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:msm8953_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:qca6174a_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:qca6390_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:qca6391_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:qca6426_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:qca6436_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:qca6574a_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:qca6574au_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:qca6574_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:qca6595au_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:qca6696_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:qca8081_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:qca8337_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:qca9377_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:qcm2290_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:qcm4290_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:qcm6490_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:qcs2290_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:qcs405_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:qcs410_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:qcs4290_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:qcs610_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:qcs6490_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:qrb5165_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:qrb5165m_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:qrb5165n_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:qualcomm215_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:sa6155p_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:sa8155p_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:sa8195p_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:sd439_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:sd460_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:sd480_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:sd662_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:sd680_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:sd690_5g_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:sd695_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:sd750g_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:sd765_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:sd765g_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:sd768g_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:sd778g_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:sd780g_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:sd855_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:sd865_5g_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:sd870_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:sd888_5g_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:sdx12_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:sdx55_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:sdx55m_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:sdx65_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:sdxr2_5g_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:sm4125_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:sm7250p_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:sm7325p_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:wcd9326_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:wcd9335_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:wcd9341_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:wcd9370_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:wcd9375_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:wcd9380_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:wcd9385_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:wcn3615_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:wcn3660b_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:wcn3680b_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:wcn3910_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:wcn3950_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:wcn3980_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:wcn3988_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:wcn3991_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:wcn3998_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:wcn3999_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:wcn6740_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:wcn6750_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:wcn6850_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:wcn6851_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:wcn6855_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:wcn6856_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:wcn7850_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:wcn7851_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:wsa8810_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:wsa8815_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:wsa8830_firmware:-:*:*:*:*:*:*:*supportedcpe:2.3:o:qualcomm:wsa8835_firmware:-:*:*:*:*:*:*:*supportedAssessments
CVSS by origin
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HAV:L/AC:L/Au:N/C:C/I:C/A:CCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLimitations and unknowns
- KEV membership is authoritative for the catalog, not proof of exposure in any environment.
- EPSS is a dated model probability and not an individual-environment prediction.
- Affected or fixed status applies only to the exact cited product and version scope; unresolved scope remains unknown.
- NVD-carried upstream facts remain derivative and are not independent corroboration.
- Only NVD metrics validated under the generation-bound calculator are Public Priority eligible; direct CVE record metrics remain display-only.
- NVD CVSS source eligibility is closed: NVD-authored, exact record-source, or registered same-CVE container origin; unmapped sources remain display-only.
- Factor D is unknown in Public Core because no accepted canonical mapping-obligation ledger is present.
- Core replay supports the active and immediately prior generation; retrospective valid-at replay is deferred.