# CVE-2026-56930: Android kernel SMMU stale TLB entry escalation

Source: https://junglewise.ai/threats/cve-2026-56930-in-smmu-find-ste-of-smmu-c-there-is-a-possible-way-to-retain  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-56930 · Severity: info · Published 2026-11-10

The Android kernel's System MMU (SMMU) driver contains a flaw that allows a local attacker to retain stale translation lookaside buffer entries across different device streams. This bypasses memory isolation controls, enabling privilege escalation without requiring special permissions or user interaction.

Technologies: [Google Android kernel](https://junglewise.ai/threats/technologies/google-android-kernel). Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-56930 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56930 being exploited in the wild.

**How severe is CVE-2026-56930?** Informational severity, published 10 November 2026.

**Which products and versions are affected?** Google Android kernel before 2026-11-05 patch level.

**Is there a fix for CVE-2026-56930?** Yes: fixed in Android security patch level 2026-11-05 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56930 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-56930?** Check whether you run Google Android kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Android security patch level 2026-11-05 or later

## Technical details

In smmu_find_ste of smmu.c, a confused deputy vulnerability allows stale TLB entries to persist across stream identifiers, breaking memory isolation boundaries. The attack is local, requires no special privileges, and results in privilege escalation by leveraging cached translations for unauthorized memory access.

## Affected products

- Google Android kernel before 2026-11-05 patch level

## Timeline

- 2026-11-10: disclosed
- 2026-11-05: patched

## References

- [https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01](https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01)

## Related threats

- [Android Kernel out-of-bounds read in KVM trace buffer initialization](https://junglewise.ai/threats/cve-2026-59048-in-rb-cpu-init-of-trace-c-there-is-a-possible-out-of-bounds-read)
- [Android Kernel KVM race condition memory corruption](https://junglewise.ai/threats/cve-2026-59045-in-multiple-locations-there-is-a-possible-memory-corruption-due)
- [Android kernel out-of-bounds write in pKVM MMU race condition](https://junglewise.ai/threats/cve-2026-59042-in-pkvm-pages-to-ppages-of-mmu-c-there-is-a-possible-out-of)
- [Android kernel integer overflow in VMA padding](https://junglewise.ai/threats/cve-2026-58845-in-multiple-locations-there-is-a-possible-out-of-bounds-write-due)
- [Android kernel out-of-bounds read/write in IOMMU](https://junglewise.ai/threats/cve-2026-58844-in-multiple-locations-there-is-a-possible-out-of-bounds-read)