CVE-2020-11148: Qualcomm APQ8017

Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days.

Use after free issue in HIDL while using callback to post event in Rx thread when internal mutex is not acquired and meantime close is triggered and callback instance is deleted in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

Affected products

• Qualcomm APQ8017: affected versions not specified
• Qualcomm APQ8053: affected versions not specified
• Qualcomm MSM8917: affected versions not specified
• Qualcomm MSM8953: affected versions not specified
• Qualcomm PM215: affected versions not specified
• Qualcomm PM3003A: affected versions not specified
• Qualcomm PM439: affected versions not specified
• Qualcomm PM6125: affected versions not specified
• Qualcomm PM6150: affected versions not specified
• Qualcomm PM6150A: affected versions not specified
• Qualcomm PM6150L: affected versions not specified
• Qualcomm PM6350: affected versions not specified
• Qualcomm PM640A: affected versions not specified
• Qualcomm PM640L: affected versions not specified
• Qualcomm PM640P: affected versions not specified
• Qualcomm PM660: affected versions not specified
• Qualcomm PM660L: affected versions not specified
• Qualcomm PM670: affected versions not specified
• Qualcomm PM670L: affected versions not specified
• Qualcomm PM7150A: affected versions not specified
• Qualcomm PM7150L: affected versions not specified
• Qualcomm PM7250: affected versions not specified
• Qualcomm PM7250B: affected versions not specified
• Qualcomm PM7350C: affected versions not specified
• Qualcomm PM8008: affected versions not specified
• and 221 more

Published 2021-01-21. Last modified 2026-06-17.