CVE-2021-25370

An incorrect file descriptor handling implementation in the dpu (display) driver of Samsung mobile devices causes memory corruption that can crash the kernel. A local process with high privileges on the device can trigger the flaw, resulting in a kernel panic and loss of device availability. Per the CVSS score, there is no direct confidentiality or integrity impact; the attacker gains only a denial-of-service crash. Any Samsung mobile device running firmware released before the March 2021 Security Maintenance Release 1 (SMR Mar-2021 Release 1) is affected. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2022-11-08, confirming active exploitation, and related reporting indicates a surveillance vendor exploited Samsung phone zero-days; ransomware use is unknown.

What to do: Update affected Samsung devices to the SMR Mar-2021 Release 1 security patch or later via the system/OTA update mechanism, and verify the installed Android security patch level is March 2021 or newer. For managed fleets, use MDM/UEM policy to enforce a minimum Android security patch level of Mar-2021 across Samsung endpoints. No workarounds are documented beyond patching; limiting high-privileged local code execution reduces trigger opportunities.