CVE-2025-21485: High Severity Vulnerability in DSP Kernel Package
Summary
CVE-2025-21485: ... Affects platform/vendor/qcom/opensource/dsp-kernel versions >= SoCVersion:0, < SoCVersion:2025-06-05. Fixed in SoCVersion:2025-06-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The DSP Kernel package, part of the Qualcomm Open Source project, is designed to facilitate efficient digital signal processing on Android devices. It plays a crucial role in managing audio and video processing tasks, ensuring optimal performance and resource utilization. However, this package has been identified as having a high-severity vulnerability that could potentially compromise device security.
Vulnerability Detail
The vulnerability identified as CVE-2025-21485 originates from a flaw in the fastrpc component of the DSP Kernel package. This issue allows unauthorized access to sensitive processes, which could lead to data leakage or unauthorized control over the DSP functionalities. The vulnerability is particularly concerning as it affects the integrity of the digital signal processing operations, potentially allowing malicious actors to exploit the system for nefarious purposes.
How To Fix
Minimum fixed version
SoCVersion:2025-06-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users are advised to limit access to the DSP functionalities and monitor for any unusual activity until the package can be updated. Additionally, implementing stricter permissions for applications that utilize DSP services may help mitigate potential risks.
Conclusion
The CVE-2025-21485 vulnerability in the DSP Kernel package poses significant risks to device security. It is crucial for users to update their packages to the patched version as soon as it becomes available and to implement temporary workarounds to mitigate risks in the meantime.
See every vulnerability recorded for platform/vendor/qcom/opensource/dsp-kernel →
FAQ
CVE-2025-21485 is a high-severity vulnerability in the DSP Kernel package that could allow unauthorized access to sensitive processes.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability could lead to data leakage, unauthorized control over DSP functionalities, and compromise the security of the device.
You can update the DSP Kernel package through your device's software update feature or by downloading the patched version from the official repository.
As a workaround, limit access to DSP functionalities and monitor for unusual activity until the patch can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/vendor/qcom/opensource/dsp-kernel.
