CVE-2025-48576 AI-generated analysis

platform/frameworks/base, NotificationManagerService (notification listener privileged channel APIs)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (7 corrections). Verify against the commit before relying on it.

Removes the unused, AIDL-only Binder method updateNotificationChannelGroupFromPrivilegedListener from INotificationManager and its NotificationManagerService implementation, eliminating a system_server entry point that created and persisted a notification channel group on behalf of a listener.

Root cause

NotificationManagerService exposed updateNotificationChannelGroupFromPrivilegedListener(token, pkg, user, group) over INotificationManager. The implementation did Objects.requireNonNull(user), verifyPrivilegedListener(token, user, false), then called createNotificationChannelGroup(pkg, getUidForPackageAndUser(pkg, user), group, false, true) and handleSavePolicyFile(). Per the commit message the method was unpublished (AIDL only) and never used. The adjacent privileged-listener methods null-check pkg (and channel), and updateNotificationChannelFromPrivilegedListener also calls verifyPrivilegedListenerUriPermission; the removed method did neither. The material does not show which specific behavior produced the bulletin's DoS classification.

How the fix works

• core/java/android/app/INotificationManager.aidl: the declaration of updateNotificationChannelGroupFromPrivilegedListener(in INotificationListener token, String pkg, in UserHandle user, in NotificationChannelGroup group) is deleted, so the Binder method no longer exists in the interface.
• services/core/java/com/android/server/notification/NotificationManagerService.java: the @Override implementation of updateNotificationChannelGroupFromPrivilegedListener (requireNonNull(user), verifyPrivilegedListener, createNotificationChannelGroup(..., false, true), handleSavePolicyFile()) is deleted from the binder service implementation inside NotificationManagerService.
• No validation is added elsewhere; the fix is pure removal of the unused entry point (commit: 'Flag: EXEMPT Code deletion').

Completeness

• The entire method is removed from both the interface and the service, so there is no residual path through this entry point.
• The sibling methods shown in context (updateNotificationChannelFromPrivilegedListener, getNotificationChannelsFromPrivilegedListener, getNotificationChannelGroupsFromPrivilegedListener) are untouched; they requireNonNull pkg (and channel) and call verifyPrivilegedListener.
• Other callers of createNotificationChannelGroup are not shown in the material; the fix does not change createNotificationChannelGroup itself.

Behavior changes

• INotificationManager no longer has updateNotificationChannelGroupFromPrivilegedListener; the method cannot be invoked through the interface.
• Removing an AIDL method renumbers the transaction codes of all methods declared after it in INotificationManager.aidl, so out-of-tree code using raw transaction codes against this interface would be affected (general platform knowledge).
• No change to NotificationListenerService public API, since the method was never used from NLS per the commit message.

Per major

• Android 14: same fix: commit 7b28c9436fff in android-security-14.0.0_r24 deletes the AIDL line and the service method; at r29 5/8 lines of the patched region are present, consistent with the deleted lines being gone.
• Android 15: same fix: commit 345b6f2a6900 in android-security-15.0.0_r12, identical deletion (AIDL context differs by setInterruptionFilter having a fromUser parameter); 5/8 region lines present at r17.
• Android 16: same fix: commit b812baa1463c in android-security-16.0.0_r3, identical deletion (AIDL context additionally contains createConversationNotificationChannelForPackageFromPrivilegedListener above the removed line); 5/8 region lines present at r8.
• Android 17: not affected per the bulletin; at android-security-17.0.0_r1 5/8 lines of the patched region are present, the same state as the fixed branches.

Unknowns

• Which behavior of the removed method produced the DoS is not shown; the DoS classification comes only from the bulletin. Missing pkg/group validation is a possibility, not shown.
• The exact failure point inside createNotificationChannelGroup / getUidForPackageAndUser for invalid arguments is not shown.
• Semantics of verifyPrivilegedListener's boolean argument and which listeners qualify are not shown in the material.
• How a stale caller using the old transaction code behaves after removal is not shown.

Back to December 2025 · Findings