Unisoc VoLTE Video-Call Exploit Chain Escalates Modem RCE to Full Android Kernel Access

Key facts for Unisoc VoLTE kernel escalation

Detection coverage for Unisoc VoLTE kernel escalation

As of 2026-08-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2049 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Unisoc ARM MPU Isolation Bypass / Kernel Memory Patch (CWE-1189)

Detects the Stage 2 privilege-escalation sequence from mobile threat defense (MTD) / kernel-integrity telemetry: the ARM coprocessor instruction pair that clears and reconfigures MPU region 0 (MCR p15,0,r0,c6,c2,0 then MCR p15,0,r0,c6,c1,4), and/or writes to the known kernel target addresses (0x804f6b58 inside __arm64_compat_sys_vmsplice, 0x804adb00 at do_sys_open, 0x821640e0 bss_stop/mutex region) documented in SSD Secure Disclosure 'UNISOC T612 LPE'. This is the moment modem-context code disables application-processor memory isolation and installs a kernel branch trampoline.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1562, T1601.001, T1014
• Data sources: mobile_threat_defense_kernel_events, android_kernel_dmesg_logcat, mdm_device_attestation
• Severity: critical
• Confidence: high

Splunk SPL

index=mobile_edr sourcetype="mtd:kernel_event" (event_type=coprocessor_register_write OR event_type=kernel_memory_write)
| search (coprocessor_op="MCR p15,0,r0,c6,c2,0" OR coprocessor_op="MCR p15,0,r0,c6,c1,4" OR target_address="0x804f6b58" OR target_address="0x804adb00" OR target_address="0x821640e0")
| eval risk="Possible Unisoc MPU region-0 isolation bypass / kernel patch (CWE-1189, SSD UNISOC T612 LPE)"
| table _time, device_id, device_model, chipset, kernel_base, coprocessor_op, target_address, process_context, risk
| where chipset IN ("T606","T612","T616","T7250")

Microsoft KQL

MobileKernelIntegrityEvents_CL
| where TimeGenerated > ago(24h)
| where ActionType_s in ("KernelMemoryPatch", "CoprocessorRegisterWrite", "MPURegionReconfigure")
| where Chipset_s in ("T606", "T612", "T616", "T7250")
| where CoprocessorInstruction_s has_any ("MCR p15,0,r0,c6,c2,0", "MCR p15,0,r0,c6,c1,4") or TargetAddress_s in ("0x804f6b58", "0x804adb00", "0x821640e0")
| project TimeGenerated, DeviceId_s, DeviceModel_s, Chipset_s, KernelBase_s, CoprocessorInstruction_s, TargetAddress_s, ProcessContext_s

Sigma

title: Unisoc ARM MPU Region-0 Isolation Bypass / Kernel Memory Patch
id: 3d9b7f1a-6e2c-4a8d-b1f0-9c4e7a2b5d6f
status: experimental
description: Detects the ARM coprocessor MPU-region-0 reconfiguration sequence and/or writes to known kernel target addresses used by the Unisoc T612 LPE to disable modem/application-processor memory isolation and install a kernel branch trampoline (CWE-1189).
references:
    - https://ssd-disclosure.com/unisoc-t612-lpe/
    - https://thehackernews.com/2026/08/unisoc-volte-video-call-exploit-chain.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/08/17
tags:
    - attack.defense-evasion
    - attack.t1562
    - attack.t1601.001
    - attack.t1014
    - cwe.1189
logsource:
    category: application
    product: android
    service: mtd
detection:
    selection_coproc:
        coprocessor_instruction|contains:
            - 'MCR p15,0,r0,c6,c2,0'
            - 'MCR p15,0,r0,c6,c1,4'
    selection_addr:
        target_address:
            - '0x804f6b58'
            - '0x804adb00'
            - '0x821640e0'
    filter_chipset:
        chipset:
            - 'T606'
            - 'T612'
            - 'T616'
            - 'T7250'
    condition: (selection_coproc or selection_addr) and filter_chipset
falsepositives:
    - Legitimate low-level modem diagnostic or field-test tooling exercising MPU/coprocessor registers under authorized firmware debugging
    - MTD/EDR agent self-instrumentation artifacts on rooted engineering/test devices
level: critical

Known false positives:

• Legitimate low-level modem diagnostic or field-test tooling exercising MPU/coprocessor registers during authorized firmware debugging
• MTD/EDR agent instrumentation artifacts on rooted engineering/test devices

Tuning notes: Restrict to devices reporting an affected Unisoc chipset (T606/T612/T616/T7250) via MDM inventory to cut noise from unrelated SoCs; maintain an exception list for authorized OEM/carrier field-test device IDs that legitimately touch these coprocessor registers.

• 🔒 Unisoc VoLTE SDP Recursion Exploit Attempt — acap:1 Flood (CWE-674) · unlock with TL Creds
• 🔒 Unisoc ARM MPU Isolation Bypass / Kernel Memory Patch (CWE-1189) · unlock with TL Creds
• 🔒 Rogue IMS Core REGISTER Followed by Burst Multi-INVITE Exploit Staging · unlock with TL Creds
• 🔒 Unisoc VoLTE SDP Recursion Exploit Attempt — acap:1 Flood (CWE-674) · unlock with TL Creds
• 🔒 Unisoc ARM MPU Isolation Bypass / Kernel Memory Patch (CWE-1189) · unlock with TL Creds
• 🔒 Rogue IMS Core REGISTER Followed by Burst Multi-INVITE Exploit Staging · unlock with TL Creds
• 🔒 Unisoc VoLTE SDP Recursion Exploit Attempt — acap:1 Flood (CWE-674) · unlock with TL Creds
• 🔒 Rogue IMS Core REGISTER Followed by Burst Multi-INVITE Exploit Staging · unlock with TL Creds

Indicators of compromise for Unisoc VoLTE kernel escalation

As of 2026-08-17, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-2049.

How Unisoc VoLTE kernel escalation works

No CVE or vendor patch exists for the privilege-escalation step, and Unisoc has not responded to disclosure outreach.

SSD Secure Disclosure published a two-stage exploit chain against Unisoc baseband firmware shared across the T606, T612, T616 and T7250 chipset family, used in budget Android phones from Motorola, Realme, and Xiaomi, with reporting also noting the chipset family's broader footprint in Honor, Samsung, and vivo devices across 140+ countries.

Stage 1 (disclosed 2026-03-11, "UNISOC T612 RCE") is a CWE-674 uncontrolled-recursion stack overflow in the modem's `_SDPDEC_AcapDecoder` SDP parser. An attacker who has registered as a UE on an IMS core network sends a SIP INVITE whose SDP body contains repeated `acap:1` attributes (`v=0` / `a=acap:1 acap:1 acap:1 [...]`); the decoder recurses without a depth limit, colliding the SIP task stack with the `sblock_0_2` task stack when the victim answers the resulting video call and SRTP packet fragmentation activates that task. This overwrites stack-resident function pointers, including the `SipHandler_AttrDecoder` handler-table entry at 0x8d0f25c0, and a PoC register write (`r1 = 0x8d0f270c`, value `0xdeadbeef`) confirms controlled corruption. ARM Thumb shellcode, split into 28-byte segments separated by 356-byte (`HOLE_BETWEEN_PARTS`) gaps to survive SIP message fragmentation, executes with modem-context privileges once the overwritten pointer is invoked.

Stage 2 (disclosed 2026-08-17, "UNISOC T612 LPE") is CWE-1189, improper isolation of shared resources on the SoC: because the modem and application processor share the same physical address space (0x00000000-0x100000000) with no hardware-enforced boundary, code already running in modem context can reconfigure ARM Memory Protection Unit region 0 via coprocessor 15 operations (`MOV r0,#0x0` / `MCR p15,0,r0,c6,c2,0` to clear the region's base, `DSB`, then `MOV r0,#0x10b` / `MCR p15,0,r0,c6,c1,4` to remap the full 32-bit address space read/write/execute, `ISB`/`DSB`). Delivery is via SIP REGISTER (rogue-IMS authentication), a REG-notification subscription, then an egg-hunter payload fragmented across five INVITE-delivered parts separated by 0x1bc-byte gaps and reassembled at 0x8de00000 using the 0xffeaef marker. A follow-up video call triggers egg-hunter execution, the MPU disable sequence, a kernel shellcode write into 0x804f6b58 inside `__arm64_compat_sys_vmsplice` (kernel base 0x80080000; a mutex/`__bss_stop` region at 0x821640e0 is also referenced by the PoC), and a branch trampoline installed at `do_sys_open` (0x804adb00) redirecting execution to the injected code -- achieving full Android kernel code execution confirmed via kernel log (`printk`) output.

Completing the full chain requires the attacker to control a private/rogue 4G IMS network (researchers used a Docker-based Open5GS core with a Kamailio SIP proxy, a Milenage-algorithm implementation for IMS/USIM authentication, a LimeSDR software-defined radio for over-the-air delivery, and Osmocom test USIMs) and the victim to answer an incoming video call -- no other user interaction is needed. Unisoc has not issued a security bulletin for the isolation flaw, the August 2026 Android Security Bulletin predates and does not cover it, and SSD states vendor outreach via email and LinkedIn went unanswered on both disclosures; Infosecurity Magazine reported its own outreach to Unisoc also went unanswered. Related prior research from Kaspersky ICS CERT (2025-11-20) found an architecturally identical modem/kernel memory-isolation gap, exploitable via the same shared-physical-address-space design pattern, on the related Unisoc UIS7862A SoC used in vehicle head units, underscoring that the flaw recurs across the Unisoc product line beyond phones.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1014 Rootkit

Initial Access

T1190 Exploit Public-Facing Application; T1664 Exploitation for Initial Access

Execution

T1203 Exploitation for Client Execution; T1658 Exploitation for Client Execution

Resource Development

T1587.004 Develop Capabilities: Exploits; T1588.002 Obtain Capabilities: Tool

defense-impairment

T1601.001 Modify System Image: Patch System Image; T1685 Disable or Modify Tools

Remediation for Unisoc VoLTE kernel escalation

Immediate actions

• Restrict or disable VoLTE/video calling where organizationally feasible on devices built with affected Unisoc T606/T612/T616/T7250 basebands
• Instruct high-risk users not to accept video calls from unknown or unverified numbers on affected devices
• Monitor for anomalous SIP REGISTER/INVITE activity or rogue IMS registrations at the carrier/network level as a compensating control

Workarounds

• No workaround fully closes the flaw; disabling VoLTE/video-calling functionality where supported by the device reduces but does not eliminate the remote attack surface

Longer-term hardening

• Replace or retire devices built on unpatched Unisoc T606/T612/T616/T7250 basebands where the threat model requires kernel-integrity assurance
• Push OEMs (Motorola, Realme, Xiaomi, and other Unisoc licensees such as Honor, Samsung, vivo) and carriers to obtain a Unisoc firmware fix enforcing hardware-level modem/application-processor memory isolation
• Favor SoC designs with hardware-enforced (not software-reconfigurable) memory isolation between baseband and application processors in future procurement

Affected and fixed versions

• Unisoc — T606 baseband/SoC
  Vulnerable versions: all shipping firmware; no patch available
• Unisoc — T612 baseband/SoC
  Vulnerable versions: MOCORTM_22A_W23.02.5_P12.14_Debug and other shipping firmware; no patch available
• Unisoc — T616 baseband/SoC
  Vulnerable versions: listed as affected in the T612 RCE advisory's affected-products; no patch available
• Unisoc — T7250 baseband/SoC
  Vulnerable versions: all shipping firmware; no patch available
• Motorola — Moto E13
  Vulnerable versions: Android security patch level 2025-02-01, Unisoc T606
• Realme — C33
  Vulnerable versions: Android security update 2025-07-01, Unisoc T612 (primary PoC target device)
• Xiaomi — Redmi A5
  Vulnerable versions: Android security patch level 2026-01-01, Unisoc T7250

Timeline of Unisoc VoLTE kernel escalation

• 2025-02-01 Motorola E13 (locked-ioc-13) test device observed at the February 2025 Android security patch level; the modem/kernel isolation flaw is not addressed at this patch level.
• 2025-07-01 Realme C33 (locked-ioc-12), the primary PoC target device, running the July 2025 Android security update, later used by locked-ioc-16 to demonstrate the full exploit chain.
• 2025-10-01 Unisoc publishes an advisory for CVE-2025-31718 (CVSS 7.5), a separate modem input-validation privilege-escalation flaw in the same T6xx/T7xx chipset family, distinct from the unpatched MPU-isolation issue.
• 2025-11-20 Kaspersky ICS CERT publishes "God Mode On," documenting an architecturally identical lack of modem/application-processor memory isolation on the related Unisoc UIS7862A SoC used in vehicle head units, including a hardware-level DMA-based path assessed as unfixable via software update.
• 2026-01-01 Xiaomi Redmi A5 (locked-ioc-10) test device observed at the January 2026 Android security patch level; the isolation flaw remains present.
• 2026-03-11 locked-ioc-4 publishes "locked-ioc-12 RCE": a CWE-674 uncontrolled-recursion stack overflow in the modem's _SDPDEC_AcapDecoder SDP parser, remotely triggerable via a malformed VoLTE video-call INVITE, granting modem-context code execution.
• 2026-08-17 The Hacker News and Infosecurity Magazine publish independent coverage of the combined two-stage exploit chain; SSD states vendor outreach to Unisoc via email and LinkedIn went unanswered on both disclosures, and Infosecurity Magazine reports its own outreach to Unisoc also went unanswered.
• 2026-08-17 The August 2026 Android Security Bulletin is published without addressing the privilege-escalation flaw; no Unisoc security bulletin covers it either.
• 2026-08-17 locked-ioc-4 publishes "locked-ioc-12 LPE": the ARM MPU region-0 coprocessor-register bypass that escalates modem-context code execution to full Android kernel code execution.

Sources cited for Unisoc VoLTE kernel escalation

• UNISOC T612 RCE - SSD Secure Disclosure ssd-disclosure.com · Advisory · 2026-03-11
• UNISOC T612 LPE - SSD Secure Disclosure ssd-disclosure.com · Advisory · 2026-08-17
• CVE-2025-31718 Detail (NVD) NVD (NIST) · Advisory · 2025-10-01
• God Mode On: Researchers run Doom on a vehicle's head unit after remotely attacking its modem Kaspersky · Research · 2025-11-20
• Unisoc Security Announcement (CVE-2025-31718) unisoc.com · Vendor report · 2025-10-01
• Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access The Hacker News · News · 2026-08-17
• UNISOC Modem Flaw Enables Remote Code Execution via Video Calls infosecurity-magazine.com · News · 2026-08-17

Threats related to Unisoc VoLTE kernel escalation

• Unisoc T612/T606/T7250 Modem Exploit Chain: Malicious VoLTE Video Call Enables Full Android Kernel Access (CVE-2025-31718 + Unpatched MPU Privilege Escalation)
• Claude Mythos / Project Glasswing: Autonomous AI Vulnerability Discovery Compresses the Find-to-Exploit Timeline (CVE-2026-4747 and the AI-Scale Disclosure Problem)
• CVE-2026-20212: Critical Unauthenticated RCE in Cisco Nexus 9000 Series Switches (Silicon One ASIC)
• 11-Year-Old Linux UEFI Shim Bootloader Flaws Enable Secure Boot Bypass (CVE-2026-8863, CVE-2026-10797)

Previous and next in vulnerability

• Critical GitLab GraphQL Flaw (CVE-2026-19478, CVSS 9.4) Could Let Unauthenticated Attackers Delete Public Projects Previous report
• GitHub Actions Workflow Injection in Snowflake .NET Connector Repo Exposed Jira Credentials Next report