Introduction
A single malformed wireless packet can instantly disable mobile connectivity on millions of Samsung Galaxy smartphones and wearables. CVE-2025-26782 is a critical flaw in the radio protocol stack of Exynos processors. An attacker within radio range can trigger a denial of service without any user interaction. The affected devices cover a broad range of Samsung hardware, including flagship phones, midrange models, and smartwatches, and the flaw has significant consequences for device reliability and operational security.
About Samsung Exynos and the involved technology: Samsung is one of the world's largest semiconductor manufacturers. Its Exynos line of system-on-chips powers hundreds of millions of devices globally, including smartphones, wearables, and standalone modems. Exynos is central to Samsung's mobile device strategy, particularly in Europe, Asia, and emerging markets.
Technical information
CVE-2025-26782 is a denial of service vulnerability in the Layer 2 (L2) Radio Link Control (RLC) Acknowledged Mode (AM) protocol implementation of Samsung Exynos baseband firmware. The flaw comes from incorrect handling of RLC AM Protocol Data Units (PDUs) during wireless packet processing. The RLC layer sits below the encryption and authentication layers in the LTE and 5G protocol stack, so malformed packets can reach the vulnerable code path before any cryptographic validation occurs.
The main technical details:
- Specially crafted RLC AM PDUs sent over the air trigger the vulnerability.
- Attackers do not need authentication or prior access to the device.
- Exploitation causes uncontrolled resource consumption (CWE-400). The modem crashes or hangs, and the device loses cellular connectivity.
- The device stays offline until it is rebooted or reset.
- Researchers at KAIST SysSec Lab discovered and analyzed the issue using the LLFuzz framework.
No public code snippets or protocol field breakdowns are available. The root cause is insufficient validation or incorrect state handling in the RLC AM PDU processing logic.
Affected systems and versions
The following Samsung Exynos processors and modems are affected:
- Exynos 9820
- Exynos 9825
- Exynos 980
- Exynos 990
- Exynos 850
- Exynos 1080
- Exynos 2100
- Exynos 1280
- Exynos 2200
- Exynos 1330
- Exynos 1380
- Exynos 1480
- Exynos 9110
- Exynos W920
- Exynos W930
- Exynos Modem 5123
- Exynos Modem 5300
These chipsets are used in Samsung Galaxy S, A, and M series smartphones, Galaxy Watch models, and other connected devices. For exact device models and version ranges, cross-reference Samsung's official advisory and device model lists.
Vendor security history
Samsung has a documented history of baseband and protocol stack vulnerabilities, including:
- Multiple critical Exynos modem vulnerabilities disclosed by Google Project Zero in 2023 (Project Zero blog)
- Buffer overflow and protocol parsing flaws in RLC and related layers, reported by academic and independent researchers
Patch response times vary. Flagship devices are typically patched more quickly than midrange or carrier-locked models. Samsung maintains a public security update portal and coordinates with external researchers.
