CVE-2025-47354: High Severity Vulnerability in DSP Kernel Package
Summary
CVE-2025-47354: ... Affects platform/vendor/qcom/opensource/dsp-kernel versions >= SoCVersion:0, < SoCVersion:2025-12-05. Fixed in SoCVersion:2025-12-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'dsp-kernel' package, developed by Qualcomm for the Android ecosystem, is integral to the Digital Signal Processing (DSP) functionalities within devices. It enables efficient processing of audio, video, and other data streams, enhancing overall performance. However, this package has been identified to contain a high-severity vulnerability that could potentially compromise system integrity.
Vulnerability Detail
The vulnerability arises from an issue in the 'fastrpc_map_create' function within the 'dsp/fastrpc.c' file. This flaw can lead to unauthorized access or manipulation of DSP resources, potentially allowing attackers to execute arbitrary code or disrupt service. The vulnerability is introduced in SoCVersion:0 and has been assigned a high severity rating due to its potential impact on device security and functionality.
How To Fix
Minimum fixed version
SoCVersion:2025-12-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider disabling the affected functionality in the DSP until the patch can be applied. This may involve modifying the configuration settings to prevent the use of the vulnerable 'fastrpc_map_create' function.
Conclusion
In summary, CVE-2025-47354 represents a significant vulnerability in the DSP kernel package that requires immediate attention. Updating to the patched version is crucial to maintain device security and functionality. Utilize tools like Vulert to monitor and assess your applications for vulnerabilities effectively.
See every vulnerability recorded for platform/vendor/qcom/opensource/dsp-kernel →
FAQ
CVE-2025-47354 is a high-severity vulnerability found in the DSP kernel package that could allow unauthorized access to DSP resources.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include potential unauthorized code execution and service disruption, which can compromise device security and functionality.
Yes, a patch is available in the updated version of the 'dsp-kernel' package, which can be installed to fix the vulnerability.
If you cannot apply the patch immediately, consider disabling the affected functionality in the DSP as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/vendor/qcom/opensource/dsp-kernel.
