Privilege Escalation via Page Use-After-Free in Qualcomm's QAIC Linux Kernel Driver

Summary

This security blog post details a privilege escalation vulnerability (page use-after-free) found in Qualcomm's QAIC (AI Accelerator) Linux Kernel Driver. The vulnerability stems from a dangling page-table entry that creates a page-level use-after-free scenario. The exploit involves reclaiming the freed physical page as a pipe_buffer slab page, which provides a very strong physical read/write primitive for privilege escalation. The post is described as relatively short because the resulting exploit primitive is extremely powerful.