Executive brief
The ARM System Memory Management Unit (SMMU) v3 is a critical security component that controls memory access for hardware devices in modern processors. A logic error in the nested secure translation entry (STE) installation code allows a local attacker with system-level privileges to escalate their access further, potentially compromising the entire system's security boundaries.
Technical details
A logic error in the smmu_install_nested_ste function of arm-smmu-v3.c allows privilege escalation. The vulnerability affects the ARM SMMU v3 driver, which manages memory access control for IO devices. An attacker with system-level execution privileges can exploit this vulnerability to escalate privileges further. The attack is local and does not require user interaction. The vulnerability was patched in Android security updates released on or after the 2026-09-05 patch level.
Affected products
- Google Android Before 2026-09-05 patch level
Timeline
- 2026-09-15: disclosed
- 2026-09-05: patched: Android security patch level 2026-09-05 or later addresses this issue