CVE-2026-20445: 
NixOS vulnerability analysis and mitigation

CVE-2026-20445 is a race condition vulnerability in MediaTek's MDDP (Mobile Data Dongle Protocol) component that can cause a system crash, leading to local denial of service. It affects Android versions 14.0, 15.0, and 16.0 running on a wide range of MediaTek chipsets including MT6835, MT6855, MT6878, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT6993, MT8188, MT8678, MT8755, MT8771, MT8797, and MT8798. The vulnerability was published on March 2, 2026, with a patch included in MediaTek's March 2026 Product Security Bulletin. It carries a CVSS v3.1 base score of 4.4 (Medium) (MediaTek Bulletin, Red Hat CVE).

The vulnerability is classified as CWE-367 (Time-of-Check Time-of-Use / TOCTOU Race Condition), where a window exists between the time a resource is checked and the time it is used, allowing an attacker to manipulate the resource state in between. Exploitation requires that the attacker has already obtained System-level privilege on the affected Android device, making this a local, privilege-dependent attack. The race condition in the MDDP component can be triggered without any user interaction, ultimately causing a system crash. The patch is identified as Patch ID: ALPS10289875; Issue ID: MSV-5184 (MediaTek Bulletin).

Successful exploitation results in a system crash, causing a local denial of service on the affected Android device. The impact is limited to availability — there is no confidentiality or integrity impact. Because exploitation requires System privilege, the attack surface is constrained to scenarios where an attacker has already achieved a high level of access on the device (MediaTek Bulletin, Red Hat CVE).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017%, reflecting a very low probability of exploitation in the near term. Exploitation is further constrained by the requirement for System-level privilege on the target device (MediaTek Bulletin).

MediaTek has released a patch (Patch ID: ALPS10289875) addressing this vulnerability, included in the MediaTek March 2026 Product Security Bulletin. Users and device manufacturers should apply OTA updates that incorporate this patch for affected chipsets running Android 14.0, 15.0, or 16.0. As an interim measure, organizations should enforce strict privilege management to limit System-level access to trusted applications only, reducing the risk of exploitation (MediaTek Bulletin).