EUVD-2026-97140
GHSA-48hc-vg85-6q45
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local low-privilege code execution
-
DeliveryOpen apsys DVFS driver interface
-
ExploitSubmit invalid frequency index
-
ExecutionTrigger OOB read / register corruption
-
ImpactCause system instability or DoS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires an attacker to already possess local, low-level privileges on the affected device (PR:L, AV:L) sufficient to invoke the kernel apsys DVFS driver interface and supply a frequency index. The limiting factors are substantial: there is no remote or network path, no unauthenticated access, and the attacker must reach the DVFS driver's input path (typically available only to on-device code with appropriate access on a Unisoc-based platform). Impact is confined to availability (system instability / denial of service via out-of-bounds read or hardware register corruption); no confidentiality or integrity compromise is described. |
| Impact | This is a moderate-severity, low-priority issue in practice. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) indicates a locally-exploitable flaw requiring existing low-level privileges, with impact limited to availability (no confidentiality or integrity loss) - consistent with the description's 'denial of service with local privileges'. No EPSS score, KEV listing, or public POC was supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation. One signal conflict exists: the input Tags include 'Buffer Overflow', but the description characterizes the flaw as an out-of-bounds READ or hardware register corruption from an unvalidated frequency index (CWE-20), which is not a classic write-based buffer overflow - treat the 'Buffer Overflow' tag with caution. Because an attacker must already hold local privileges on the device to reach the apsys DVFS driver, this is a local privilege-dependent DoS rather than a remotely-triggerable or wormable issue, placing it well below internet-facing critical flaws in triage priority. |
| Exploit ScenarioDerived | A malicious or compromised app/process already running with local low-level privileges on a Unisoc-based device invokes the apsys DVFS driver with a crafted, out-of-range frequency index. The driver fails to validate the index, causing an out-of-bounds read or corruption of hardware DVFS registers, destabilizing or crashing the system. No public POC was provided, and remote or unauthenticated triggering is not supported by the CVSS vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Improper validation of the frequency index passed to the Unisoc kernel apsys DVFS driver (CVE-2026-87765, CVSS 3.1 5.5) lets local code that already holds low-level privileges on the device select an out-of-range operating point, resulting in an out-of-bounds read of the driver's frequency/voltage tables or corruption of the power-management hardware registers, which can destabilize or crash the system. Impact is limited to availability (C:N/I:N/A:H) - no confidentiality or integrity loss is described - and the assessed vector AV:L/AC:L/PR:L/UI:N means there is no remote or unauthenticated path; an attacker must already be able to invoke the DVFS driver interface locally. Exploitation signals are weak: no public exploit code exists and there is no confirmed active exploitation (not listed in CISA KEV), and no EPSS score was supplied, so this should be treated as a moderate-severity, low-priority issue remediated through vendor firmware/driver updates rather than emergency action.
RemediationAI
No vendor-released patch version was identified in the provided intelligence; the actionable path is to monitor and apply the Unisoc product security bulletin at https://www.unisoc.com/en/support/product-security-bulletin/2109454821805424641 and the corresponding OEM firmware or BSP kernel updates for the specific affected chipset, then confirm the fix by checking the kernel build fingerprint rather than assuming any driver update resolves it. Until a fixed build is deployed, compensating controls should focus on restricting who can reach the DVFS input path: apply SELinux/AppArmor or similar mandatory access control policy so that only the vendor power/thermal management daemons (running as privileged system services) may open the DVFS ioctl/sysfs nodes, and deny untrusted applications and secondary local users access to those nodes - the trade-off is that overly broad policy can break thermal throttling, power tuning, benchmark utilities, and vendor diagnostics, so it must be tuned per device image. Where the DVFS interface is exposed through engineering/debug knobs, closing or removing those debug entry points reduces the attack surface at the cost of losing field diagnostics, and disabling unneeded DVFS sysfs write access entirely is a stronger but more disruptive option that can affect battery life and thermal behaviour. Because exploitation already requires local low-level privileges (PR:L, AV:L), these mitigations are hardening measures rather than fixes and provide only incremental risk reduction; prioritizing a vendor kernel update is the only measure that removes the missing bounds check.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The apsys DVFS (Dynamic Voltage and Frequency Scaling) driver is a Unisoc platform kernel component that translates a requested performance level into hardware clock and regulator programming, typically by indexing a frequency/voltage table (operating performance points) or by writing a raw index into a clock/power-controller register. The reported root cause is CWE-20 (Improper Input Validation): the frequency index arriving from userspace-controlled interfaces (ioctl/sysfs power-management nodes or vendor debug paths) is not range-checked against the size of the table or the hardware's valid index space before use. That is precisely the classic primitive behind an out-of-bounds read - the driver reads past the end of an in-kernel table - and behind hardware register corruption, where an out-of-range index is programmed into a PLL/clock/power register and leaves the SoC in an inconsistent state. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H confirms a local attack that needs existing low-level privileges (PR:L) with no user interaction and no scope change, and the availability-only impact matches a crash, hang, or forced reboot rather than memory disclosure or write of attacker-controlled data to persistent storage. No CPE strings were supplied in the available intelligence; identification of the vulnerable assets rests on the Unisoc vendor bulletin rather than normalized CPE inventory, which should be taken into account when scoping affected fleets.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local driver reachable only by on-device low-privileged code (AV:L/PR:L), no user interaction, and an unvalidated index reliably triggers it (AC:L); impact is DoS-only (A:H, C:N/I:N).
Primary rating from Vendor (unisoc).
CVSS VectorVendor: unisoc
DescriptionCVE.org
In the kernel apsys DVFS driver, there is a possible out-of-bounds read or hardware register corruption due to improper input validation of the frequency index. This could lead to system instability or denial of service with local privileges.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB