PoC Released for Nothing Phone Code-Execution Vulnerability

A proof-of-concept exploit has been published for a critical flaw in the secure boot process of the Nothing Phone (2a) and CMF Phone 1. The PoC, named fenrir, patches the function sec_get_vfy_policy() in bl2_ext to always return zero, bypassing the authentication policy and allowing any boot image to load without checks, which could enable full code execution at the highest privilege level (EL3) and undermine the secure boot chain after Preloader execution.

The exploit files, including Python, C and shell scripts, are described as part of the PoC and the build/flash process is laid out with steps to patch and flash patched images to a device via fastboot. The vulnerability has been confirmed on the Nothing Phone (2a) and CMF Phone 1, with preliminary testing suggesting other MediaTek-based phones such as the Vivo X80 Pro may also be at risk.

Users are advised not to unlock their bootloaders until official patches are released, and the full PoC repository is available under the AGPL-3.0 licence on GitHub for researchers and device vendors to review and verify. The article, dated 9 October 2025, notes that device makers and chipset vendors must update secure boot verification to enforce checks on bl2_ext even when unlocked.