CVE-2025-20765: In aee daemon, there is a possible system crash due to a race condition

Description

In aee daemon, there is a possible system crash due to a race condition. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10190802; Issue ID: MSV-4833.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack vector

Local

Complexity

High

Privileges

Low

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.1% · higher than 0% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

AN

Android · Google

14.0; 15.0; 16.0 · source: NVD

MM

MT2718, MT2737, MT6739, MT6761, MT6765, MT6768, MT6781, MT6789, MT6833, MT6835, MT6853, MT6855, MT6877, MT6878, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6893, MT6895, MT6897, MT6899, MT6980D, MT6983, MT6985, MT6989, MT6990, MT6991, MT8113, MT8115, MT8139, MT8163, MT8168, MT8169, MT8 · MediaTek, Inc.

Android 14.0, 15.0, 16.0 / openWRT 21.02, 23.05 / Yocto 4.0 · source: vendor

OP

Openwrt · Openwrt

21.02.0; 23.05.0 · source: NVD

YO

Yocto · Linuxfoundation

4.0 · source: NVD