CVE-2023-43515 is a medium severity (CVSS 6.6) buffer overflow in Qualcomm software. Memory corruption in the high level operating system occurs while running kernel address sanitizers (syzkaller) on tmecom with DEBUG_FS enabled. Qualcomm's April 2024 bulletin covers it. Ask your device maker for the patched build.
What's affected
The record's product list includes the FastConnect 6900 and FastConnect 7800 chipsets with their firmware, and the bulletin is the reference for the full list. The bulletin page loads its content with scripts, so I could not read its text when I fetched it. The statements on this page come from the NVD record only.
The description says the memory corruption occurs in the HLOS, the high level operating system, while running kernel address sanitizers (syzkaller) on tmecom with DEBUG_FS enabled. In plain terms, the problem surfaced while fuzz testing a driver component with a debug filesystem switched on. That context suggests the exposure is mostly for development and debug builds, but the record does not say so, and the bulletin may.
The weakness is CWE-120, a classic buffer copy without a size check. The vector is local and needs a low privilege account, with high impact on integrity and low impact on confidentiality and availability.
How to check if you're exposed
There is nothing to query with a package manager. Start with an inventory of devices based on the chipsets in the bulletin, and compare each device's software build with the vendor's notes. For Android devices, read the security patch level in Settings, About phone, Android version.
If you ship or manage development builds, check whether DEBUG_FS is enabled in them. On a Linux based device with shell access you can see whether the debug filesystem is mounted:
mount | grep debugfs
Production builds normally keep it off or restricted.
What to do now
- Read the April 2024 Qualcomm bulletin and match its chipsets to your devices.
- Ask device vendors for the build that includes the fix and install it.
- Turn off DEBUG_FS or restrict it on production builds you control.
- Keep debug and development builds off production networks.
- Limit local code execution on devices, since the vector is local.
- Track vendor status for each affected device in your inventory.
Why it matters
The weakness, CWE-120, is a copy into a buffer without checking the size. In kernel code that means writing past the end of a buffer, which corrupts nearby memory. Fuzzers such as syzkaller are good at finding exactly these cases, which is why finding the bug during sanitizer testing is not surprising.
The medium score of 6.6 reflects a local vector and a requirement for a low privilege account. The mention of DEBUG_FS in the description hints that the debug interface is part of the path, which would limit exposure on locked down production devices. I cannot confirm that from the record alone, so check the bulletin. The KEV flag is false.
Quick check
Does it only matter if DEBUG_FS is on?
The description mentions DEBUG_FS in the circumstances where the bug was found, but the record does not say it is required. Read Qualcomm's bulletin and your vendor's notes.
Sources
Last reviewed: 19 October 2026.
