Android Kernel Exploited

Overview

Security researchers at SSD Secure Disclosure have unveiled a two‑stage exploit chain that grants attackers full Android kernel access on devices running Unisoc modem firmware. Triggered through a VoLTE video call, this exploit chain currently has no fix from Unisoc, leaving millions of devices vulnerable across brands like Motorola, Realme, and Xiaomi.

Exploit Chain Breakdown

• Stage 1 (March 2026): Remote code execution (RCE) via a malformed SIP video call.
• Stage 2 (August 2026): Privilege escalation classified as CWE‑1189.
• Attack requirements:
  • Control of a private 4G cellular network.
  • Victim answers the incoming VoLTE video call.
• Execution path:
  • Modem‑level foothold from Stage 1.
  • Exploit writes a full‑access configuration to the modem’s ARM Memory Protection Unit (MPU).
  • Maps the entire 32‑bit physical address space as readable, writable, and executable, including Android kernel memory.
  • Shared physical memory between modem and application processor enables kernel modification.

Affected Devices

Researchers confirmed the flaw on:

• Motorola E13 (Feb 2025 patch).
• Xiaomi Redmi A5 (Jan 2026 patch).
• Chipsets: Unisoc T606, T612, T7250.

Unisoc supplies components to brands across 140+ countries, amplifying the global risk.

Security Implications

• Kernel‑level execution: Attackers gain full control of the Android kernel.
• No patch available: Neither the August 2026 Android Security Bulletin nor Unisoc advisories address this flaw.
• Architectural weakness: Shared memory between modem and application processor creates systemic risk.
• Historical precedent: Kaspersky ICS CERT documented similar conditions in 2025 on Unisoc UIS7862A chips used in vehicle head units.

Defensive Guidance

Device owners should:

• Monitor for firmware updates: Watch manufacturer advisories for patches.
• Limit VoLTE exposure: Disable VoLTE video calling if possible.
• Avoid untrusted networks: Exploitation requires attacker‑controlled infrastructure.
• Stay informed: Track disclosures from SSD Secure Disclosure and Android Security Bulletins.

Expert in the Cloud Insight

This exploit chain highlights a critical blind spot in mobile security: modem firmware vulnerabilities that bridge into the Android kernel. Because the flaw stems from shared memory architecture, it’s not just a software bug—it’s a systemic design issue. Until Unisoc commits to firmware updates, enterprises and consumers alike must treat VoLTE video calls on affected devices as a high‑risk vector.