CVE-2025-61614: 
NixOS vulnerability analysis and mitigation

CVE-2025-61614 is an improper input validation vulnerability in the NR (New Radio/5G) modem component affecting Android devices powered by Unisoc chipsets (T7300, T8100, T9100, T8200, T8300). The flaw can cause a system crash, leading to remote denial of service with no authentication or additional privileges required. Affected Android versions include 13.0, 14.0, 15.0, and 16.0. The vulnerability was published on March 9, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (Red Hat Advisory, Unisoc Advisory, Android Bulletin).

The root cause is classified as CWE-20 (Improper Input Validation) within the NR modem firmware component on Unisoc chipsets. An unauthenticated remote attacker can send malformed or unexpected input over the network to the modem subsystem, triggering an unhandled condition that results in a system crash. No user interaction or elevated privileges are required, and the attack vector is entirely network-based. No public technical write-ups or proof-of-concept code have been identified at this time (Unisoc Advisory, Android Bulletin).

Successful exploitation results in a system crash on the affected Android device, causing a complete loss of availability for the duration of the crash or until the device is restarted. The impact is limited to availability — there is no confidentiality or integrity impact, and the vulnerability does not enable code execution or data exfiltration. Affected devices include those running Android 13 through 16 on Unisoc T7300, T8100, T9100, T8200, and T8300 chipsets, potentially impacting a broad range of consumer and enterprise mobile devices (Unisoc Advisory, Android Bulletin).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.20%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Red Hat Advisory).

Patches are available from both Unisoc and Google. Users should apply the Android March 2026 security patch level (2026-03-01 or later), which includes the fix for this vulnerability. Device manufacturers using affected Unisoc chipsets should integrate the patch from Unisoc's security advisory. No configuration-based workarounds have been published; updating to the patched firmware/OS version is the recommended remediation (Unisoc Advisory, Android Bulletin).

Coverage of CVE-2025-61614 has been limited to automated vulnerability tracking platforms and aggregators such as VulDB, CVEFeed, and security blogs. Samsung's March 2026 security patch details were noted to include this bulletin (Sammyfans). No notable independent researcher commentary or significant media coverage has been identified beyond routine CVE publication notices.