CVE-2026-58766: ARM SMMU v3 Privilege Escalation Vulnerability

CVE-2026-58766 Overview

CVE-2026-58766 is a local privilege escalation vulnerability in the ARM System Memory Management Unit version 3 (SMMU-v3) driver. The flaw resides in multiple functions within arm-smmu-v3.c and stems from a logic error in the driver code. A local attacker with low privileges can exploit the flaw to escalate to elevated privileges. Exploitation requires no user interaction and no additional execution privileges. Google addressed the issue in the Android Security Bulletin for September 2026, which covers Pixel and other Android devices using this kernel driver.

Critical Impact
Local attackers can gain elevated privileges on affected Android devices without user interaction, undermining kernel isolation boundaries enforced by the SMMU-v3 IOMMU driver.

Affected Products

Android devices using the Linux kernel arm-smmu-v3 driver
Google Pixel devices covered by the September 2026 Android Security Bulletin
ARM-based systems relying on SMMU-v3 for DMA isolation

Discovery Timeline

2026-09-15 - CVE-2026-58766 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-58766

Vulnerability Analysis

The vulnerability affects the ARM SMMU-v3 driver implemented in arm-smmu-v3.c. The SMMU-v3 is the ARM IOMMU responsible for translating device DMA addresses and enforcing isolation between devices and kernel memory. A logic error across multiple driver functions allows a local low-privileged actor to reach a state where privileges can be escalated. The issue is classified under [CWE-693] Protection Mechanism Failure, indicating that a security control fails to operate as intended. Because the flaw undermines an IOMMU-enforced boundary, exploitation can subvert the isolation the driver is designed to provide.

Root Cause

The root cause is a logic error in the driver code paths responsible for managing SMMU-v3 state. Protection Mechanism Failure weaknesses of this type typically arise from missed edge cases, incorrect ordering of checks, or state transitions that leave the driver operating without the guarantees callers assume. Full technical detail has not been published beyond the vendor bulletin.

Attack Vector

Exploitation is local. An attacker requires low privileges on the target device, such as those available to an installed unprivileged application. No user interaction is required. Successful exploitation results in privilege escalation with high impact to confidentiality, integrity, and availability of the affected system. Public exploit code is not currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code has been published. Refer to the Android Security Bulletin September 2026 for authoritative technical detail.

Detection Methods for CVE-2026-58766

Indicators of Compromise

Unexpected privilege transitions from unprivileged processes to root or system UIDs on ARM-based devices.
Abnormal kernel log entries referencing arm-smmu-v3 state changes or fault handlers.
Installation of untrusted applications immediately preceding elevated process activity.

Detection Strategies

Monitor kernel audit logs for anomalous SMMU fault events and unexpected device attach or detach operations.
Correlate application launch telemetry with subsequent process privilege changes to identify local escalation attempts.
Track builds and patch levels across the device fleet to identify devices not yet updated to the September 2026 Android security patch level.

Monitoring Recommendations

Enable and centrally collect Android and kernel audit logs from managed devices.
Alert on execution of unsigned or newly installed applications on devices missing the September 2026 patch level.
Review DMA and IOMMU-related kernel messages for patterns consistent with driver misuse.

How to Mitigate CVE-2026-58766

Immediate Actions Required

Apply the September 2026 Android security patch level on all affected Pixel and Android devices.
Inventory ARM-based devices running the arm-smmu-v3 driver and confirm patch status.
Restrict installation of untrusted third-party applications on unpatched devices.

Patch Information

Google published fixes for this vulnerability in the Android Security Bulletin September 2026. Devices at security patch level 2026-09-01 or later address the issue. OEMs that ship the mainline Linux arm-smmu-v3 driver should incorporate the corresponding upstream kernel patches.

Workarounds

No vendor-supplied workaround exists; apply the security patch as the primary remediation.
Enforce mobile device management policies that block sideloading and restrict application sources on unpatched devices.
Decommission or isolate devices that cannot receive the September 2026 patch level.

bash

# Verify the Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
# Expected output: 2026-09-01 or later