CVE-2026-58755: ARM SMMU-v3 Privilege Escalation Vulnerability

CVE-2026-58755 Overview

CVE-2026-58755 is a local privilege escalation vulnerability in the Linux kernel's Arm System Memory Management Unit version 3 (SMMUv3) driver. The flaw resides in the smmu_install_nested_ste function within arm-smmu-v3.c. A logic error in the code allows an attacker with System-level execution privileges to escalate to higher privileges without user interaction. The issue was disclosed as part of the Android Security Bulletin for September 2026 and carries CWE-693 (Protection Mechanism Failure).

Critical Impact
Local attackers holding System execution privileges can escalate to kernel-level privileges on affected Android and Linux devices using Arm SMMUv3, compromising confidentiality, integrity, and availability.

Affected Products

Linux kernel Arm SMMUv3 driver (drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c)
Android devices shipping with the vulnerable Arm SMMUv3 IOMMU driver
Pixel devices covered by the September 2026 Android Security Bulletin

Discovery Timeline

2026-09-15 - CVE-2026-58755 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-58755

Vulnerability Analysis

The vulnerability affects smmu_install_nested_ste, a function responsible for installing nested Stream Table Entries (STEs) in the Arm SMMUv3 IOMMU driver. Nested STEs enable two-stage address translation used by virtualization workloads, where Stage 1 is controlled by a guest and Stage 2 by the host hypervisor. A logic error in this code path breaks an intended protection mechanism, allowing an attacker with local System privileges to influence translation state improperly.

Successful exploitation grants elevated privileges on the affected device. Because the SMMU governs Direct Memory Access (DMA) from peripheral devices, mismanaged STE installation can permit unauthorized memory access across trust boundaries. The vulnerability does not require user interaction and is exploitable entirely from local context.

Root Cause

The root cause is a logic error in the nested STE installation routine, categorized as CWE-693 (Protection Mechanism Failure). The function fails to correctly enforce constraints when configuring the nested translation entry, allowing state that should be rejected or sanitized. This weakens memory isolation guarantees that the IOMMU is designed to provide.

Attack Vector

The attack vector is local. An attacker must already execute code with System privileges on the device to reach the vulnerable code path. Once inside that context, the flawed logic can be triggered to escalate privileges further into kernel space. Refer to the Android Security Bulletin September 2026 for vendor-supplied technical details.

Detection Methods for CVE-2026-58755

Indicators of Compromise

Unexpected kernel log entries from the arm-smmu-v3 driver referencing nested STE operations or IOMMU faults
Processes holding System UID that spawn unexpected child processes or load kernel modules
Anomalous DMA activity from peripherals coinciding with privilege changes on the device

Detection Strategies

Monitor kernel ring buffer (dmesg) for SMMU translation faults or unusual STE reconfiguration events
Baseline expected IOMMU behavior on managed Android and Linux endpoints, and alert on deviations
Correlate System-privileged process activity with subsequent kernel-privileged actions such as module loads or /dev/kmem-adjacent access

Monitoring Recommendations

Ingest kernel and Android system logs into a centralized analytics platform for retrospective search
Track patch level attributes (ro.build.version.security_patch) across the fleet and flag devices below the September 2026 baseline
Enable audit rules covering privilege changes, capability grants, and IOMMU-related syscalls where supported

How to Mitigate CVE-2026-58755

Immediate Actions Required

Apply the September 2026 Android security patch level (2026-09-01 or later) to all affected Pixel and Android devices
Rebuild and deploy Linux kernels containing the corrected smmu_install_nested_ste implementation for non-Android systems using Arm SMMUv3
Inventory devices running Arm-based platforms with SMMUv3 enabled and prioritize those exposed to untrusted local code

Patch Information

Google addressed CVE-2026-58755 in the September 2026 Android Security Bulletin. Device manufacturers integrating the Arm SMMUv3 driver should incorporate the upstream kernel fix and ship updated firmware to end users. See the Android Security Bulletin September 2026 for patch references and affected component details.

Workarounds

Restrict which processes and services run with System privileges to reduce the pool of potential attackers
Disable nested SMMU translation on hosts where virtualization workloads are not required, if supported by the platform
Enforce application allowlisting and code integrity policies to limit unauthorized code execution at the System privilege tier

bash

# Verify current Android security patch level
adb shell getprop ro.build.version.security_patch
# Expected output for a patched device: 2026-09-01 or later