CVE-2026-58747 Overview
CVE-2026-58747 is a local privilege escalation vulnerability in the ARM System Memory Management Unit v3 (SMMU) driver used by the Linux kernel and Android. The flaw resides in the smmu_detach_dev function within arm-smmu-v3.c. A logic error in the detach path allows a permission bypass that can be leveraged for local escalation of privilege to System-level execution. Exploitation does not require user interaction. The issue is tracked in the Android Security Bulletin for September 2026 and is categorized under [CWE-693] Protection Mechanism Failure.
Critical Impact
Local attackers with existing privileged access can bypass IOMMU-enforced device isolation and escalate to System privileges on affected Android and Linux-based devices.
Affected Products
- Android devices using the ARM SMMU v3 driver (per Android Security Bulletin, September 2026)
- Linux kernel builds shipping the arm-smmu-v3.c driver
- Pixel devices covered by the September 2026 Pixel Update Bulletin
Discovery Timeline
- 2026-09-15 - CVE-2026-58747 published to the National Vulnerability Database (NVD)
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-58747
Vulnerability Analysis
The vulnerability is a Protection Mechanism Failure in the ARM SMMU v3 driver, which is responsible for enforcing DMA isolation between devices and system memory. The smmu_detach_dev routine handles the removal of a device from an existing SMMU domain. A logic error in this function permits a state where permission enforcement is bypassed during or after detach. The result is that a local actor with System-adjacent privileges can influence device-memory mappings that should otherwise be denied. Successful exploitation yields local escalation to System execution privileges without any user interaction.
Root Cause
The root cause is a logic error in smmu_detach_dev within arm-smmu-v3.c. The function does not correctly enforce the domain permission state during device detach, leaving a window where access checks are inconsistent with the intended IOMMU protection policy. Under [CWE-693], the protection mechanism exists but does not function as designed.
Attack Vector
Exploitation requires local access with high privileges on the target device. A malicious component running with elevated but bounded privileges can invoke driver code paths that trigger smmu_detach_dev under attacker-controlled conditions. Because the flaw bypasses IOMMU protections, an attacker can influence memory or device operations reserved for System. The Android bulletin classifies the outcome as local elevation of privilege.
No verified public exploit or proof-of-concept is available at the time of publication. Technical specifics are limited to the description in the Android Security Bulletin September 2026.
Detection Methods for CVE-2026-58747
Indicators of Compromise
- Unexpected kernel log entries referencing arm-smmu-v3, SMMU fault events, or repeated domain detach and attach cycles on the same device
- Processes with elevated privileges spawning shells or writing to protected system paths shortly after driver interaction
- Installation or execution of unsigned kernel modules or privileged binaries on devices that should be locked down
Detection Strategies
- Monitor Android and Linux kernel audit logs for anomalous IOMMU domain manipulation and SMMU fault patterns
- Correlate privileged process activity with driver ioctl or sysfs interactions targeting SMMU-managed devices
- Baseline expected device attach and detach sequences and alert on deviations from normal boot and runtime patterns
Monitoring Recommendations
- Ingest kernel and dmesg telemetry from managed Android and Linux endpoints into a centralized analytics pipeline
- Track patch level attributes across the fleet and flag devices missing the September 2026 Android security patch level
- Alert on privilege escalation chains where a service-level process obtains System-level capabilities without an expected authentication event
How to Mitigate CVE-2026-58747
Immediate Actions Required
- Apply the September 2026 Android security patch level to all affected Pixel and OEM devices
- Update Linux kernels that include the arm-smmu-v3 driver to a version incorporating the upstream fix
- Restrict local access on affected systems and enforce least-privilege for services that can interact with SMMU-managed hardware
- Inventory devices by patch level and prioritize remediation for devices exposed to untrusted local code
Patch Information
Google addressed the issue in the Android Security Bulletin September 2026. Devices at the 2026-09-01 or later Android security patch level include the fix. Linux distributions shipping the ARM SMMU v3 driver should track the corresponding upstream kernel commit and backport the correction to smmu_detach_dev.
Workarounds
- No vendor-supplied workaround has been published; upgrading to the patched version is the required remediation
- Reduce exposure by limiting installation of third-party privileged software and disabling developer or debug interfaces on production devices
- Enforce verified boot and strict SELinux policies to constrain what a compromised privileged process can reach
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
