Unisoc VoLTE Exploit Chain Opens Android Kernel via Modem — No…

A two-stage exploit chain in Unisoc VoLTE modems lets an attacker with a rogue 4G network achieve full Android kernel access when the victim answers a video call. The root cause is architectural: no hardware isolation between the modem and application processors on the world's most widely used budget SoCs, leaving a gap that Google's monthly security patches cannot close. No CVE has been assigned, no patch is available, and Unisoc has not responded to disclosure attempts for roughly five months.

On August 17, 2026, SSD Secure Disclosure published the second stage of an exploit chain targeting the VoLTE modems in Unisoc SoCs, enabling an attacker who controls a rogue 4G network to gain full Android kernel access after the victim answers a video call. The issue is structural: the lack of hardware isolation between the modem processor and the application processor in the world's most ubiquitous budget chips exposes a gap that Google's monthly security patches cannot close.

Key Takeaways

The SSD advisory dated August 17, 2026 documents Stage 2 of a chain that began in March 2026: RCE in the modem via malformed SIP/SDP, then privilege escalation to the Android kernel through shared physical memory
The only barrier between the modem and the application processor is the ARM Memory Protection Unit, which is software-reconfigurable from code running in the modem itself
No CVE has been assigned to the chain, no patch is available, and the August 2026 Android Security Bulletin does not include the vulnerability
SSD attempted to contact Unisoc via email and LinkedIn without response for roughly five months, since the Stage 1 release

How the Chain Works: From Modem to Kernel in Two Stages

The chain unfolds in two sequential stages. Stage 1, disclosed by SSD in March 2026, exploits a memory corruption in Unisoc's modem firmware through SIP INVITE messages with malformed SDP bodies. This allows arbitrary code execution in the modem processor context — the first link in the chain.

Stage 2, published on August 17, 2026, escalates privileges to the Android kernel. Independent researcher 0x50594d developed the proof-of-concept on a Realme C33 with the T612 SoC, confirming the vulnerability also on the Motorola E13 (February 2025 patch level) and Xiaomi Redmi A5 (January 2026 patch level). The T7250 is vulnerable; the T616, described as a "close relative" of the T612, is unconfirmed.

The technical mechanism exploits an architectural characteristic of Unisoc SoCs: the modem processor and application processor share the same physical memory space without hardware isolation. The only separation relies on the ARM Memory Protection Unit, which the researchers reconfigured by writing to the ARM coprocessor registers via MCR p15 instructions. The configuration marks the entire 32-bit physical address space — from 0x00000000 to 0x100000000 — as readable, writable, and executable from the modem context.

With this mapping, the payload overwrote the Android kernel resident at physical address 0x80080000, confirmed on the tested devices. Exploit success is verified by observing printk('Exploit worked!') in the target device's kernel logs.

The PoC: Rogue 4G Network and Payload Fragmentation

The attack architecture documented by SSD requires the attacker to control a private 4G network. The proof-of-concept relies on defined open-source components and hardware: Open5GS for the core network, LimeSDR as the software-defined radio, and programmable Osmocom SIM cards. The Stage 2 payload uses an egg-hunter technique with fragmentation into 0x4b0-byte chunks to bypass the modem firmware's memory allocation constraints.

The dossier does not confirm that the chain works on real commercial 4G networks without modifications. The attack requires the victim to answer the VoLTE video call; it is not a zero-click compromise.

"The condition making this possible is a shared physical memory space between the modem processor and the application processor within the Unisoc SoC, with no hardware-enforced boundary preventing modem-context code from modifying kernel memory" — SSD Secure Disclosure, via The Hacker News

Unisoc's Silence and the Accountability Vacuum in Secondary Chipmakers

SSD attempted to contact Unisoc through email and LinkedIn without receiving a response. Researcher 0x50594d published the full PoC. The silence has persisted for roughly five months, since the Stage 1 release.

This silence places Unisoc in a distinct position relative to the standard Android supply chain. Google's monthly security patches, which cover the OS and Qualcomm components for Pixel devices and certified partners, do not extend their coverage to Unisoc's proprietary modem firmware. The result is a persistent firmware attack surface, invisible to CVE-based vulnerability management processes and unaddressed by Android release cycles.

The precedent of CVE-2022-20210 (CVSS 9.8, disclosed by Check Point Research) demonstrates that Unisoc can patch modem vulnerabilities when it chooses to. The lack of action in this case raises questions about disclosure procedures and the responsibility of non-top-tier chipmakers in the mobile ecosystem.

Unisoc holds approximately 14% of the global smartphone SoC market in the first half of 2026, according to Counterpoint Research. Devices with these chips — Motorola, Xiaomi, Realme, Samsung entry-level — are distributed in over 140 countries, with concentration in emerging markets where update channels are already fragmented.

Why This Matters

The brief specifies no available mitigations and no actions users can take independently. The absence of a CVE and an official Unisoc advisory prevents the vulnerability from entering enterprise patch management systems and vulnerability management tools.

The dossier does not document whether CVE-2025-31718, published in October 2025, is related to the SSD disclosure of March 2026. No infrastructure overlap emerges linking the current chain to active attack campaigns or in-the-wild exploits at this time.

Kaspersky ICS CERT research from November 2025 had already documented the same architectural condition — shared physical memory without hardware isolation — on the UIS7862A chip in automotive units. This convergence indicates the design problem is not confined to smartphones.

What the Market Doesn't Say

Android supply-chain fragmentation creates an implicit security hierarchy: top-tier Qualcomm and MediaTek chips face more intense scrutiny, with structured advisories, bug bounty programs, and integration into Google's patch cycles. Unisoc operates outside this perimeter despite being the third-largest smartphone SoC vendor globally by volume.

The result is structural blindness. OEMs that ship Unisoc chips — Motorola, Xiaomi, Realme, Samsung in the entry-level tier — lack mechanisms to distribute firmware fixes independent of the chip vendor. The end user receives Android updates that do not touch the modem firmware, with the illusion of a protected surface.

Unisoc's five-month non-response, in an industry where coordinated disclosure cycles typically run 90 days, signals an accountability vacuum the market has no tools to sanction. Budget device security is not a niche problem; it is the security problem for the majority of global Android users.

Information is based on the cited advisory and current as of publication.

Sources

Information is based on the cited source and current as of publication.

Sources

Sources and references