Unisoc VoLTE Video-Call Exploit Chain Reaches Android Kernel —…

SSD Secure Disclosure details a two-stage exploit chain on Unisoc chipsets that starts with a malicious VoLTE video call and ends with full Android kernel privileges. Affected chips include the T606, T612, and T7250 in devices patched as recently as January 2026. Unisoc has not responded to reports from March and August, and the August 2026 Android Security Bulletin contains no mitigation.

On August 17, 2026, SSD Secure Disclosure published an advisory for a two-stage exploit chain that jumps from Unisoc modem firmware to the Android kernel with full privileges. The vulnerability, classified as CWE-1189 for improper isolation of resources on a System-on-Chip, affects T606, T612, and T7250 chipsets in devices updated through January 2026. No CVE has been assigned, and Unisoc has not responded to reports sent in March and August.

Key Takeaways

The exploit chain requires a VoLTE video call on an attacker-controlled 4G network to achieve RCE in the modem firmware
From the modem context, researchers disabled the ARM MPU via coprocessor registers, mapping the entire 32-bit physical address space as readable, writable, and executable
Confirmed vulnerable devices: Motorola E13, Realme C33, and Xiaomi Redmi A5 with Android patches from February 2025, July 2025, and January 2026 respectively
Unisoc did not respond for five months to reports via email and LinkedIn; the August 2026 Android Security Bulletin includes no mitigation

The architectural flaw lies in physical memory shared between the modem processor and the application processor inside the Unisoc SoC, with no hardware-enforced boundary preventing code running in the modem context from modifying kernel memory. According to the SSD Secure Disclosure advisory, cited by The Hacker News, the only barrier is the ARM Memory Protection Unit — configurable from the modem side.

In the second stage of the exploit, researchers wrote a full-access MPU configuration via MCR p15 instructions, operating on the coprocessor registers that govern memory domains. The result maps the entire 32-bit physical address space as RWX — readable, writable, and executable — from the modem context.

TechTimes and Dark Reading provided additional details. Dark Reading described 0x4b0-byte shellcode fragments pre-loaded in the modem heap, with an egg-hunter mechanism that reassembles the payload in physical memory. TechTimes identified physical address 0x80080000 as the location of the Android kernel on tested devices.

From SIP/SDP to printk: The Chain Confirmed in the Lab

The first stage, developed in March 2026, exploits malformed SIP/SDP messages during VoLTE video-call negotiation to gain remote code execution in the modem firmware. The second stage, published in August, escalates privileges from the modem to the Android kernel.

Researchers confirmed kernel-level execution by observing printk output in kernel logs, according to The Hacker News. The proof-of-concept used an Open5GS 4G core, a LimeSDR software-defined radio, and Osmocom SIM cards to simulate the network infrastructure. The source does not specify whether the same chain works on commercial cellular networks without modification.

"The condition that makes all this possible is a shared physical memory space between the modem processor and the application processor inside the Unisoc SoC, without any hardware-enforced boundary preventing code in the modem context from modifying kernel memory" — SSD Secure Disclosure, via The Hacker News

The Accountability Void: Android Patches That Don't Touch the Modem

The structure of the problem exposes an inconsistency in the Android security model. Monthly OS updates distributed by Google and OEMs do not include modem firmware, which is the property of the chipset vendor and is updated — if ever — on separate, often opaque channels invisible to the user.

As TechTimes observes, "a phone updated with the latest Android patches could be running modem firmware that has never been updated." The precedent of CVE-2022-20210, a Unisoc modem vulnerability the vendor fixed and delivered via the Android Security Bulletin, demonstrates the technical capacity to respond. The choice not to do so in the current cases is deliberate, not a technical limitation.

Unisoc holds roughly 14% of the global smartphone SoC market in H1 2026, according to Counterpoint Research. Its chips power devices sold in over 140 countries by Motorola, Realme, Xiaomi, Samsung, Honor, vivo, Nokia, and ZTE. Not all devices from these brands are confirmed vulnerable; the dossier explicitly documents only the Motorola E13, Realme C33, and Xiaomi Redmi A5.

Independent Confirmation: Kaspersky and the Same Flaw in Other Contexts

In November 2025, Kaspersky ICS CERT independently documented the same architectural condition on a Unisoc UIS7862A SoC in a vehicle head unit. There, too, the modem and application processor shared physical memory without hardware isolation; researchers achieved kernel access via a hidden DMA peripheral.

The Kaspersky research is not directly linked to the VoLTE exploit chain published by SSD Secure Disclosure, but it corroborates the pattern: the lack of isolation is not a defect limited to a single chipset or a single attack path, but a design choice with repercussions across multiple product lines.

What to Do Now

The absence of patches leaves OEMs and users without direct operational levers: modem firmware is not updatable through standard Android channels. This structural condition, documented in the brief, prevents any autonomous mitigation by the end user or system administrator.

Modem firmware remains under the exclusive control of the chipset vendor. Monthly Android updates do not touch this component, which receives patches — when it receives them — through opaque and often inaccessible processes. The CVE-2022-20210 case shows Unisoc is technically capable of patching, but five months of silence on the current reports indicates a choice not to intervene.

For users, the source specifies no effective countermeasure beyond awareness of the architectural risk. The chain is confirmed only on a controlled 4G network, not on commercial networks, but the nature of the bug — RWX access to kernel physical memory — makes the impact maximal if replicated on public infrastructure.

Why It Matters

The Unisoc case highlights a governance gap in the mobile supply chain. Google controls the OS, OEMs assemble devices, but modem firmware — a component with privileges equal to or greater than the kernel — remains a gray zone without effective oversight. The August 2026 Android Security Bulletin includes no entry for this vulnerability, and no Unisoc bulletin mentions it.

The CVE-2022-20210 precedent shows the vendor already knew how to handle this class of bug. The current silence, documented by the same sources that verified the exploit chain, is not attributable to technical incompetence. It is a choice not to respond in a sector where fragmented responsibility — among chipset vendor, OEM, and OS steward — leaves end users without a point of contact.

Unisoc's 14% market share, concentrated in the sub-$150 segment, means the most vulnerable devices are those with the least access to technical support and rapid replacement. The source does not specify the exact number of exposed devices, but the combination of confirmed kernel access, absent patches, and vendor silence defines a high-risk profile for the remaining lifecycle of these products.

Information is based on the SSD Secure Disclosure advisory and derived technical analyses.

Information has been verified against cited sources and is current as of publication.

Sources

Sources and references

The Mechanism: When the Modem and Application Processor Share Physical Memory