{"id":"CVE-2026-56930","kind":"vulnerability","aliases":["CVE-2026-56930"],"related":[],"title":"Linux kernel SMMU driver: stale TLB entries let local users escalate privileges","description":"In smmu_find_ste of smmu.c, there is a possible way to retain stale translation lookaside buffer entries across stream identifiers due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"In the kernel's SMMU (IOMMU) driver, stale translation lookaside buffer entries can be kept across stream identifiers because of a confused deputy flaw. A local user with no extra privileges can use this to escalate privileges to higher levels.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arm-smmu","infrastructure","linux","linux-kernel"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:15+00:00","first_seen_at":"2026-11-10T20:46:07+00:00","triaged_at":"2026-11-10T20:53:48+00:00","updated_at":"2026-11-10T20:53:48+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T20:53:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel SMMU driver: stale TLB entries let local users escalate privileges","impact":"high","summary":"In the kernel's SMMU (IOMMU) driver, stale translation lookaside buffer entries can be kept across stream identifiers because of a confused deputy flaw. A local user with no extra privileges can use this to escalate privileges to higher levels.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","arm-smmu","linux"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated privileges on the machine","analyst_note":"Find the affected kernel version ranges and fixed commits from the NVD entry or kernel.org CVE record for CVE-2026-56930.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"The text describes a local privilege escalation in the arm SMMU driver (smmu.c) of the kernel, so machines running a kernel with that driver on ARM hardware are the ones to look at. The sources do not state which kernel versions or configurations are affected, and the description does not say whether a default configuration is involved.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000695,"input_tokens":4541,"output_tokens":482,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-56930':15A,18A 'across':42B,85C 'addit':103C 'arm':20B 'arm-smmu':19B 'buffer':37B,83C 'confus':48B,91C 'could':94C 'cve':13A,16A 'deputi':49B,92C 'driver':4A,33B 'due':88C 'entri':7A,38B,84C 'escal':11A,62B,98C 'execut':104C 'exploit':113C 'extra':56B 'find':69C 'flaw':50B 'higher':65B 'identifi':44B,87C 'infrastructur':22B 'interact':108C 'iommu':32B 'kept':41B 'kernel':2A,26B,29B 'lead':95C 'let':8A 'level':66B 'linux':1A,23B,25B 'linux-kernel':24B 'local':9A,52B,97C 'lookasid':36B,82C 'need':106C,111C 'possibl':76C 'privileg':12A,57B,63B,100C,105C 'retain':79C 'smmu':3A,21B,31B,68C 'smmu.c':72C 'stale':5A,34B,80C 'ste':70C 'stream':43B,86C 'tlb':6A 'translat':35B,81C 'use':59B 'user':10A,53B,107C 'way':77C","nicknames":[],"mitigations":[],"who_affected":"The text describes a local privilege escalation in the arm SMMU driver (smmu.c) of the kernel, so machines running a kernel with that driver on ARM hardware are the ones to look at. The sources do not state which kernel versions or configurations are affected, and the description does not say whether a default configuration is involved.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["armsmmu","infrastructure","linux","linuxkernel","unknown"],"campaign_type":null,"search_a":"'-2026':14A,17A '-56930':15A,18A 'cve':13A,16A 'driver':4A 'entri':7A 'escal':11A 'kernel':2A 'let':8A 'linux':1A 'local':9A 'privileg':12A 'smmu':3A 'stale':5A 'tlb':6A 'user':10A","search_b":"'across':42B 'arm':20B 'arm-smmu':19B 'buffer':37B 'confus':48B 'deputi':49B 'driver':33B 'entri':38B 'escal':62B 'extra':56B 'flaw':50B 'higher':65B 'identifi':44B 'infrastructur':22B 'iommu':32B 'kept':41B 'kernel':26B,29B 'level':66B 'linux':23B,25B 'linux-kernel':24B 'local':52B 'lookasid':36B 'privileg':57B,63B 'smmu':21B,31B 'stale':34B 'stream':43B 'translat':35B 'use':59B 'user':53B","search_c":"'across':85C 'addit':103C 'buffer':83C 'confus':91C 'could':94C 'deputi':92C 'due':88C 'entri':84C 'escal':98C 'execut':104C 'exploit':113C 'find':69C 'identifi':87C 'interact':108C 'lead':95C 'local':97C 'lookasid':82C 'need':106C,111C 'possibl':76C 'privileg':100C,105C 'retain':79C 'smmu':68C 'smmu.c':72C 'stale':80C 'ste':70C 'stream':86C 'translat':81C 'user':107C 'way':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-56930","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56930","severity":null,"published_at":"2026-11-10T20:19:15+00:00","modified_at":"2026-11-10T20:19:15+00:00","first_seen_at":"2026-11-10T20:46:07+00:00","fetched_at":"2026-11-10T20:46:07+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}