Executive brief
A memory safety bug in the ARM System Memory Management Unit (SMMU) driver allows a local attacker with system-level privileges to trigger a use-after-free condition. Successful exploitation could lead to system privilege escalation or a complete device compromise, affecting the kernel's ability to properly manage memory access on ARM-based devices including Google Pixel phones.
Technical details
The vulnerability is a use-after-free due to a logic error in multiple functions within arm-smmu-v3.c, a Linux kernel component managing IOMMU memory access. The flaw allows an attacker with system execution privileges to manipulate reference counting or lifetime management of kernel objects, leading to access of freed memory. The vulnerability is exploitable locally without user interaction; an attacker can craft operations that trigger the use-after-free condition. Patches addressing this issue are included in Android security patch level 2026-09-05 or later.
Affected products
- Google Android versions prior to 2026-09-05 patch level
- Linux Kernel unspecified
Timeline
- 2026-09-15: disclosed: Published in Google Pixel Update Bulletin
- 2026-09-05: patched: Patch available in Android security patch level 2026-09-05 and later