Executive brief
A logic error in the ARM System Memory Management Unit (SMMU) v3 device handling code allows a local attacker with system-level access to bypass memory protection controls. This could enable privilege escalation or unauthorized access to protected memory regions, potentially compromising system security and data isolation.
Technical details
The vulnerability is a permission bypass in the smmu_detach_dev function of arm-smmu-v3.c, caused by a logic error in the code. The vulnerability allows local privilege escalation when exploited by an attacker with System execution privileges. The attack does not require user interaction. The SMMU is a core kernel component responsible for enforcing memory protection and device isolation; a logic error here could permit unauthorized device access or memory region remapping.
Affected products
- Linux Linux Kernel <UNKNOWN>
Timeline
- 2026-09-15: disclosed
- 2026-09-05: patched: Included in Pixel security patch level 2026-09-05