CVE-2025-21436: High Severity Vulnerability in platform/vendor/qcom/opensource/dsp-kernel
Summary
CVE-2025-21436: ... Affects platform/vendor/qcom/opensource/dsp-kernel versions >= SoCVersion:0, < SoCVersion:2025-04-05. Fixed in SoCVersion:2025-04-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The platform/vendor/qcom/opensource/dsp-kernel package is a crucial component of the Android ecosystem, providing essential functionalities for digital signal processing. This package is integral to the performance and efficiency of various applications that rely on DSP capabilities. However, it has been found to contain a high-severity vulnerability that could potentially compromise system integrity.
Vulnerability Detail
The vulnerability identified as CVE-2025-21436 originates from improper handling of memory mapping and device I/O operations within the fastrpc subsystem of the dsp-kernel package. This flaw could allow an attacker to exploit the system, leading to unauthorized access to sensitive data or denial of service. The vulnerability affects multiple functions within the fastrpc.c file, making it critical for users to address it promptly to prevent potential exploitation.
How To Fix
Minimum fixed version
SoCVersion:2025-04-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit access to the affected functions within the fastrpc subsystem by implementing stricter access controls and monitoring for unusual activity until the package can be updated.
Conclusion
The CVE-2025-21436 vulnerability in the platform/vendor/qcom/opensource/dsp-kernel package poses significant risks to system integrity and data security. It is crucial for users to update their packages to the patched version to mitigate these risks effectively. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for platform/vendor/qcom/opensource/dsp-kernel →
FAQ
CVE-2025-21436 is a high-severity vulnerability found in the platform/vendor/qcom/opensource/dsp-kernel package that could allow unauthorized access to sensitive data.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to sensitive data, potential denial of service, and overall system compromise.
Yes, a patch was released on April 5, 2025. Users should update to this version to mitigate the vulnerability.
If immediate updates are not possible, implement stricter access controls and monitor the system for any unusual activity as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/vendor/qcom/opensource/dsp-kernel.
