Official released 5th Oct 2026
Preface: The memory (RAM) for the Snapdragon 888+ 5G Mobile Platform is technically an external chip, but it is physically stacked directly on top of the processor using a technology called PoP (Package on Package). When a CPU chip boots up, hardware security features (such as the memory protection unit (MPU) or TZASC/TZMA) must first designate a specific area as “secure memory.” If an insecure loader can rewrite the page table and map it to that area beforehand, once the secure memory is initialized and confidential data is written to it, the insecure end may bypass the permission check through the previously established page table mapping.
Background: In a real hardware system, AWPROT (the security/non-security attribute bit on the AXI bus) is automatically driven by the hardware Master (such as the CPU core or a Secure DMA) via physical circuits during a bus transaction. This means you cannot simply write a statement like AWPROT = 0; in regular C code.
To control AWPROT on the AXI bus, the coding approach depends on whether you are working at the CPU software level (switching CPU security states) or at the RTL hardware description level (designing AXI Master/Slave logic).
When an ARM CPU executes a memory write instruction (such as STR), the hardware automatically sets the AWPROT attribute on the bus based on the current security state of the CPU:
•When the CPU is in the Secure World → Hardware automatically sets AWPROT[1] = 0.
•When the CPU is in the Normal World → Hardware automatically sets AWPROT[1] = 1.
Please see the accompanying infographic. When a CPU chip boots up, hardware security features (such as the memory protection unit (MPU) or TZASC/TZMA) must first designate a specific area as “secure memory.” If an insecure loader can rewrite the page table and map it to that area beforehand, once the secure memory is initialized and confidential data is written to it, the insecure end may bypass the permission check through the previously established page table mapping.
Vulnerability details: CVE ID : CVE-2026-25267
Title: Missing Authorization in Core
Description: Memory corruption when non-secure loader rewrites page tables before secure memory initialization.
Technology Area: Core
Vulnerability Type: CWE-862: Missing Authorization
Access Vector : Local
Official announcement: Please refer to the link for details –
https://docs.qualcomm.com/securitybulletin/october-2026-bulletin.html