CVE-2025-47394: High Severity Vulnerability in platform/vendor/qcom/opensource/dsp-kernel
Summary
CVE-2025-47394: ... Affects platform/vendor/qcom/opensource/dsp-kernel versions >= SoCVersion:0, < SoCVersion:2026-03-05. Fixed in SoCVersion:2026-03-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The platform/vendor/qcom/opensource/dsp-kernel package is a critical component of the Android ecosystem, providing essential functionalities for digital signal processing. This package is utilized in various Qualcomm System on Chips (SoCs) and is integral to the performance and efficiency of Android devices. However, it has been identified to contain a vulnerability that could potentially be exploited, leading to severe consequences for device security and stability.
Vulnerability Detail
The vulnerability identified as CVE-2025-47394 originates from a flaw in the dsp-kernel's handling of certain operations within the fastrpc.c file. This issue could allow an attacker to manipulate memory allocations, leading to potential crashes or unauthorized access to sensitive data. The severity of this vulnerability is classified as high, indicating that it poses a significant risk to affected systems, particularly those utilizing the vulnerable SoC versions.
How To Fix
Minimum fixed version
SoCVersion:2026-03-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users are advised to limit access to the affected components of the dsp-kernel until the patch can be applied. This may involve disabling certain functionalities that rely on the vulnerable code in fastrpc.c.
Conclusion
In summary, CVE-2025-47394 represents a significant security risk within the platform/vendor/qcom/opensource/dsp-kernel package. Users are strongly encouraged to update to the patched version to mitigate potential threats. For those unable to update immediately, implementing temporary workarounds is advisable.
See every vulnerability recorded for platform/vendor/qcom/opensource/dsp-kernel →
FAQ
CVE-2025-47394 is a high severity vulnerability found in the platform/vendor/qcom/opensource/dsp-kernel package, which could allow attackers to exploit memory handling issues.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include potential crashes, unauthorized access to sensitive data, and overall instability of the affected devices.
Yes, a patch is available and can be applied by updating to the version released on March 5, 2026.
If you cannot apply the patch immediately, it is recommended to limit access to the affected components as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/vendor/qcom/opensource/dsp-kernel.
