Modem Memory Flaw Opens Door to Kernel Takeover

A fresh disclosure from the SSD Secure Disclosure team has highlighted a security gap in UNISOC modem firmware that could let an attacker who has already compromised the modem escalate access all the way to the Android kernel. The research, credited to independent security researcher 0x50594d, demonstrates a full chain of exploitation where modem-level code execution is extended into kernel-level execution, with the final trigger being a simple video call.

Modem-Kernel Isolation Gap

The root cause lies in a lack of proper isolation between modem memory and kernel memory. That allows code running in the modem context to access physical memory, including the memory used by the Android kernel. The flaw is classified as CWE-1189, or Improper Isolation of Shared Resources on a System-on-a-Chip (SoC).

According to the researchers, the missing isolation means an attacker who has already obtained code execution on the modem can disable protections on a Memory Protection Unit (MPU) region, giving the modem context access to physical memory. This is a critical boundary crossing, as it moves the attack from the modem's limited environment into the broader kernel space.

Exploit Chain Uses Video Call

SSD's disclosure details a full exploit chain tested against a Realme C33 smartphone with an Android security update from July 2025. The test builds on a previously disclosed UNISOC T612 RCE and shows how the researchers managed to execute a payload in kernel space.

The final stage of the attack was triggered by placing a video call to the target phone, using a Voice over Long-Term Evolution (VoLTE) connection in their test environment. This practical trigger demonstrates how a remote caller could potentially initiate the chain, making the vulnerability particularly concerning for real-world exploitation.

“The flaw stems from a lack of isolation between modem memory and kernel memory.”

— SSD Secure Disclosure technical team

Affected Devices Listed

The issue has been identified in phones using UNISOC chipsets. SSD lists the Xiaomi Redmi A5, which has a security patch dated January 1, 2026, and the Motorola E13, with a February 1, 2025 security patch, among affected devices. However, SSD notes that these are not an exhaustive inventory of all potentially affected phones.

UNISOC (Shanghai) Technologies is a top-three global fabless semiconductor company headquartered in Shanghai, specializing in 2G/3G/4G/5G mobile communication, IoT, and smart device chipsets. The broad deployment of UNISOC chipsets in budget and mid-range smartphones makes this a potentially wide-reaching issue.

No Vendor Response Yet

The disclosure does not identify any vendor firmware update that addresses the flaw. SSD said it attempted to contact UNISOC through email and LinkedIn, and Infosecurity Magazine also contacted UNISOC for comment but had not received a response at the time of writing.

For owners of affected devices, the disclosure points to firmware updates from UNISOC and handset manufacturers as the key route to remediation. Until such updates are released, users may have limited options to protect themselves beyond exercising caution with calls from unknown numbers.

Similar Risks Elsewhere in Modems

The disclosure notes that similar risks have been demonstrated in other cellular modem components. For example, Cinterion modem vulnerabilities disclosed in 2024 were reported to allow remote attackers to execute arbitrary code and manipulate device memory.

This pattern suggests that modem security is a recurring challenge across the industry, as modems are often treated as separate entities with less stringent security scrutiny compared to the main application processor.

Implications for Users

This vulnerability underscores the importance of keeping mobile devices updated with the latest security patches. Even if a user does not consider themselves a target, the exploit chain could be triggered remotely via a video call, which removes the need for physical access.

The lack of a confirmed fix from UNISOC makes this a waiting game for affected users. In the meantime, users should remain aware that their device's security may be at risk and should monitor for any firmware updates from their device manufacturers.

As the research shows, the boundary between modem and kernel is not always as solid as it should be. This could mean that other UNISOC devices are also vulnerable, and it raises questions about how many other chipsets have similar isolation gaps.

Ultimately, this disclosure is a reminder that mobile security is a layered challenge, and every component—from the modem to the kernel—must be properly isolated to prevent attacks from escalating.