{"id":"CVE-2026-0178","kind":"vulnerability","aliases":["CVE-2026-0178"],"related":[],"title":"Linux arm64 SMMU driver: stale entries let local code bypass DMA isolation","description":"In multiple functions of arm-smmu-v3.c, there is a possible way to bypass direct memory access isolation via stale stream table entries due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.","summary":"In the arm-smmu-v3 driver, a logic error leaves stale stream table entries that can bypass direct memory access isolation. A local process with system-level execution privileges can escalate its privileges.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arm64","infrastructure","kernel","linux","smmu"],"not_affected_if":["no-arm-smmu-v3-hardware","x86-only-hosts"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:17:20+00:00","first_seen_at":"2026-11-10T20:46:00+00:00","triaged_at":"2026-11-10T20:54:13+00:00","updated_at":"2026-11-10T20:54:13+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T20:54:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux arm64 SMMU driver: stale entries let local code bypass DMA isolation","impact":"high","summary":"In the arm-smmu-v3 driver, a logic error leaves stale stream table entries that can bypass direct memory access isolation. A local process with system-level execution privileges can escalate its privileges.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["linux","arm64","kernel","smmu"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local code escalates privileges and bypasses DMA memory isolation","analyst_note":"Find the affected kernel version ranges and the fixing commit for arm-smmu-v3.c from the Linux kernel CVE record or the Android security bulletin.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-arm-smmu-v3-hardware","x86-only-hosts"],"who_is_affected":"Systems running Linux on ARM64 hardware that uses the Arm SMMUv3 IOMMU, where the arm-smmu-v3 driver is loaded. The sources do not name affected kernel versions or product ranges. Exploitation needs local code execution at system privilege, so machines without untrusted local users are at lower risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000708,"input_tokens":4538,"output_tokens":509,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0178':15A,18A '-2026':14A,17A 'access':44B,77C 'arm':27B,64C 'arm-smmu-v3':26B,63C 'arm64':2A,19B 'bypass':10A,41B,74C 'c':67C 'code':9A 'could':90C 'cve':13A,16A 'direct':42B,75C 'dma':11A 'driver':4A,30B 'due':84C 'entri':6A,38B,83C 'error':33B,88C 'escal':56B,94C 'execut':53B,99C 'exploit':108C 'function':61C 'infrastructur':20B 'interact':103C 'isol':12A,45B,78C 'kernel':21B 'lead':91C 'leav':34B 'let':7A 'level':52B 'linux':1A,22B 'local':8A,47B,93C 'logic':32B,87C 'memori':43B,76C 'multipl':60C 'need':101C,106C 'possibl':71C 'privileg':54B,58B,96C,100C 'process':48B 'smmu':3A,23B,28B,65C 'stale':5A,35B,80C 'stream':36B,81C 'system':51B,98C 'system-level':50B 'tabl':37B,82C 'user':102C 'v3':29B,66C 'via':79C 'way':72C","nicknames":[],"mitigations":[],"who_affected":"Systems running Linux on ARM64 hardware that uses the Arm SMMUv3 IOMMU, where the arm-smmu-v3 driver is loaded. The sources do not name affected kernel versions or product ranges. Exploitation needs local code execution at system privilege, so machines without untrusted local users are at lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["arm64","infrastructure","kernel","linux","smmu","unknown"],"campaign_type":null,"search_a":"'-0178':15A,18A '-2026':14A,17A 'arm64':2A 'bypass':10A 'code':9A 'cve':13A,16A 'dma':11A 'driver':4A 'entri':6A 'isol':12A 'let':7A 'linux':1A 'local':8A 'smmu':3A 'stale':5A","search_b":"'access':44B 'arm':27B 'arm-smmu-v3':26B 'arm64':19B 'bypass':41B 'direct':42B 'driver':30B 'entri':38B 'error':33B 'escal':56B 'execut':53B 'infrastructur':20B 'isol':45B 'kernel':21B 'leav':34B 'level':52B 'linux':22B 'local':47B 'logic':32B 'memori':43B 'privileg':54B,58B 'process':48B 'smmu':23B,28B 'stale':35B 'stream':36B 'system':51B 'system-level':50B 'tabl':37B 'v3':29B","search_c":"'access':77C 'arm':64C 'arm-smmu-v3':63C 'bypass':74C 'c':67C 'could':90C 'direct':75C 'due':84C 'entri':83C 'error':88C 'escal':94C 'execut':99C 'exploit':108C 'function':61C 'interact':103C 'isol':78C 'lead':91C 'local':93C 'logic':87C 'memori':76C 'multipl':60C 'need':101C,106C 'possibl':71C 'privileg':96C,100C 'smmu':65C 'stale':80C 'stream':81C 'system':98C 'tabl':82C 'user':102C 'v3':66C 'via':79C 'way':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:17:20+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-0178","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0178","severity":null,"published_at":"2026-11-10T20:17:20+00:00","modified_at":"2026-11-10T20:17:20+00:00","first_seen_at":"2026-11-10T20:46:00+00:00","fetched_at":"2026-11-10T20:46:00+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}