Check your Android phone against the SMS of Death bug

by

What you need: your phone, a Wi-Fi connection, and about 5 minutes for the check, plus however long your phone takes to download an update and restart. The number to look for is a security patch level of 2026-10-01 or later. This guide covers Pixel and Galaxy menus, a fallback for other brands, and what to do if a phone is already misbehaving (as of 1 November 2026).

What the bug does, and what’s still disputed

On 29 October, researcher Mark Blaszczyk published details of a flaw he calls “SMS of Death”, tracked as CVE-2026-58882. eSecurityPlanet reports that a specially crafted WAP Push SMS can disrupt Android’s telephony framework, and that the message never shows up in the inbox. Android also doesn’t reveal the sender’s number.

The effect ranges from a nuisance to a dead phone. Cyber Security News says each message causes one to two seconds without service, and active calls end with the cause CS_DEATH. In the worst case, ShiftDelete reports, the phone falls into a reboot loop and lands on the recovery screen roughly every 90 seconds.

Why does it keep coming back? The carrier resends texts the phone never acknowledges, so one message caused repeated outages for up to a week in testing. A factory reset is no cure either: CyberInsider says queued messages were subsequently redelivered after a reset.

Whether a fix exists is where the coverage splits. GSMArena says Google denied the issue when it was reported in May, then included a fix with the October security patch for devices running Android 14 or later. Cyber Kendra reports that Google closed the report for the final time on October 29 as a non-security issue. I couldn’t confirm the CVE against Google’s own bulletin, so treat the October patch as the best available protection, not a guarantee.

Our calculation: from Blaszczyk’s report on 5 May to his public disclosure on 29 October is 177 days (26 + 30 + 31 + 31 + 30 + 29). Google’s own engineering change, per eSecurityPlanet, was committed on June 15, 41 days after the report.

Step 1: Find your patch level

The menu paths below come from published guides for Android 17 on Pixel (Android Central covers its June 16 release for Pixel 6 and newer) and for One UI on Galaxy phones. Manufacturers rename things between versions, so the Settings search box is your backup.

On a Pixel (Android 17)

  1. Open Settings.
  2. Tap Security & privacy, then System & updates.
  3. Read the date next to Android security update. Pixel guides also point to this same screen.

On a Samsung Galaxy

  1. Open Settings, scroll down and tap About phone.
  2. Tap Software information.
  3. Read the date on the Android security patch level line. It takes about 20 seconds.

On One UI 6 and newer there’s a second route. Settings > Security and privacy shows Security update with the date of your current patch, plus a separate Google Play system update date. The two dates are different things, and only the first one counts here.

On any other Android phone

Try Settings > About phone > Android version, which MakeUseOf lists as the path on most devices. If it isn’t there, type “security patch” into the Settings search bar.

Step 2: Read the date correctly

Google’s October bulletin uses a single patch level. According to SecurityWeek, it arrives on devices as 2026-10-01, a change from the two-part releases of past years. Fleet explains that phones reporting 2026-10-01 or later carry the bulletin’s fixes, and that a date such as 2026-10-05 is fine because a later level includes the earlier one.

Anything earlier, such as 2026-09-05, is missing the October fixes. The Android version number won’t tell you this; a phone on Android 17 can still be a month behind.

Step 3: Install the update

Plug the phone in and join Wi-Fi first. Then follow the path for your brand.

Pixel

  1. Open Settings > System > Software updates > System update.
  2. Tap Check for update.
  3. Download and install, then tap Restart when asked.
  4. Return to Settings > Security & privacy > System & updates and confirm the date reads 2026-10-01 or later.

Pixel owners should see it quickly. Basic Tutorials says the October Pixel update brings patch level 2026-10-01 to Pixel models from the Pixel 6 through the Pixel 11.

Samsung Galaxy

  1. Open Settings > Software update.
  2. Tap Download and install. Some guides label this area System updates > Check for system updates, so use whichever your phone shows.
  3. Let it install and restart.
  4. Go back to Settings > About phone > Software information and recheck the patch level.

ROIhacks notes that a Pixel, Galaxy, OnePlus or Motorola device may receive the same bulletin patch on different dates. If nothing is offered yet, check again in a few days rather than hunting for unofficial firmware.

If your phone runs Android 12 or 13

Here the news is poor. eSecurityPlanet says the bug affects Android 12 through 16 and that Google’s fix covers Android 14 through 17. Phones on 12 and 13 get nothing from the October update.

That isn’t a small group. As of October 2026, 10.98% of Android devices run Android 13, according to Wikipedia’s version tracker. I found no documented setting that blocks WAP Push messages, so there’s no switch to flip.

Your realistic options are to check whether your maker has a newer build for the model, to keep the phone as a secondary device, or to replace it. If you stay put, know the risk: the proof-of-concept code is public, and the damage is lost calls and mobile service rather than stolen data.

If your phone is already crashing

Signs include calls that end for no reason, mobile signal that flickers for a second or two, and in bad cases a recovery screen that keeps appearing. First, install the update if you can reach the Settings app. A patched phone should discard the bad message instead of choking on it; GSMArena says Android removes the message on the spot once it recognises one of the 20 malicious patterns it checks for.

If the phone is stuck in the reboot loop, the recovery prompt will offer a wipe. Don’t take it. The project page at smsofdeath.com says you should not choose “wipe data” at the recovery prompt, and a wipe may only buy you time while the carrier redelivers the message.

The recovery route has two parts, and it needs a computer.

  1. Stop the resends. Blaszczyk moved the physical SIM into a non-Android device, such as an iPhone, so the pending messages were acknowledged. CyberInsider adds that he warns recovery could be harder for eSIM users.
  2. Clear the queue over ADB. Connect the phone to a computer with Android Debug Bridge installed. In the short window after boot completes, query the pending-message store at content://sms/raw, let the shell write to SMS storage, delete only the rows from the bad sender, then reset that permission.
  3. Know the last resort. The same page lists a command that clears the telephony provider, which erases all SMS/MMS and APN settings. Use it only if the targeted delete fails.

Copy the exact commands from the community workaround on GitHub instead of retyping them from memory. The commands are a community fix posted next to the disclosure, and they require a computer and some technical skill. If that’s out of reach, a repair shop or your carrier’s support desk is the safer bet.

Common problems and fixes

Symptom Likely cause Fix
No update shows under Software update Staged rollout; your maker hasn’t released it for your model or region Check again in a few days; confirm your patch level in About phone
Patch level still earlier than 2026-10-01 after updating Update didn’t finish, or the maker shipped an older build Restart, check for update again, then recheck Software information
Phone is on Android 12 or 13 October fix covers Android 14 to 17 only Look for a newer build; otherwise consider replacing the phone
Calls drop; signal vanishes for 1 to 2 seconds Telephony process crashing on a bad message Install the October update; restart the phone
Recovery screen about every 90 seconds Bad message stuck in the pending queue Refuse “wipe data”; clear the queue over ADB
Factory reset didn’t help Carrier redelivered the unacknowledged message Move the SIM to a non-Android phone, then clear the queue over ADB
You use an eSIM No physical SIM to move Expect a harder recovery; ask your carrier for help

What this means for you

Spend 5 minutes today. Open your patch level, and if it’s earlier than 2026-10-01, install the update tonight on Wi-Fi with the phone charging. Pixel owners on Android 17 should be covered; Galaxy owners may need to wait for their region’s release.

If you share a phone with a parent or relative, check theirs too. They’re the people most likely to be a month behind on updates and least likely to notice a silent crash until calls start failing.

Keep the recovery steps in mind but don’t rehearse them. Most people never need ADB, and the one thing worth remembering is to decline “wipe data” at the recovery prompt. If you rely on a phone running Android 12 or 13 for work or emergencies, plan a replacement rather than waiting for a patch that sources say isn’t coming.

Sources

Header image: illustration, AI-generated.

Leave a Comment