Executive brief
ARM's System Memory Management Unit (SMMU) v3 is a hardware component that manages memory access control and isolation on mobile devices and servers. A flaw in the smmu_detach_dev_nested function allows an attacker with system-level access to bypass input validation and escalate their privileges, potentially gaining complete control over the device or system.
Technical details
The vulnerability is a privilege escalation (EoP) in the ARM SMMU v3 driver (arm-smmu-v3.c), specifically in the smmu_detach_dev_nested function, caused by improper input validation. The flaw allows a local attacker with system execution privileges to bypass security checks and elevate their privileges further. No user interaction is required for exploitation. The vulnerability affects the kernel's memory management unit driver and patches are available via Android security updates with patch level 2026-09-05 or later.
Affected products
- Google Pixel prior to 2026-09-05 security patch level
Timeline
- 2026-09-15: disclosed
- 2026-09-05: patched