{"id":"CVE-2026-56944","kind":"vulnerability","aliases":["CVE-2026-56944"],"related":[],"title":"Linux kernel: SMMU detach use-after-free allows local privilege escalation","description":"In smmu_detach_dev of private/google-modules/iommu/arm-smmu-v3/drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c, there is a possible Use After Free due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.","summary":"A logic error in the Arm SMMU v3 driver's device detach path (smmu_detach_dev, pKVM build) can cause a use-after-free. A local user with normal execution rights can use it to escalate privileges.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","arm-smmu-v3","linux-kernel","pkvm","runtime"],"not_affected_if":["no-arm-smmu-v3","stock-kernel"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:16+00:00","first_seen_at":"2026-11-10T20:46:07+00:00","triaged_at":"2026-11-10T20:53:39+00:00","updated_at":"2026-11-10T20:53:39+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-10T20:53:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: SMMU detach use-after-free allows local privilege escalation","impact":"high","summary":"A logic error in the Arm SMMU v3 driver's device detach path (smmu_detach_dev, pKVM build) can cause a use-after-free. A local user with normal execution rights can use it to escalate privileges.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["linux-kernel","arm-smmu-v3","pkvm","android"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user escalates to kernel-level privileges","analyst_note":"Find the affected kernel versions and fixed commit from the NVD entry or the Android security bulletin for this CVE; the sources here give no product ranges.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-arm-smmu-v3","stock-kernel"],"who_is_affected":"Only systems running the Google pKVM build of the Arm SMMU v3 driver are described; the sources do not list affected kernel versions or configurations. Teams running stock kernels or no Arm SMMU hardware with this driver can likely skip it, but the sources do not confirm this.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000704,"input_tokens":4606,"output_tokens":486,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-56944':15A,18A 'allow':9A 'android':19B 'arm':21B,34B 'arm-smmu-v3':20B 'build':46B 'caus':48B 'code':87C 'could':89C 'cve':13A,16A 'detach':4A,40B,43B,69C 'dev':44B,70C 'devic':39B 'driver':37B 'due':80C 'error':31B,84C 'escal':12A,65B,93C 'execut':59B,98C 'exploit':107C 'free':8A,53B,79C 'interact':102C 'kernel':2A,26B 'lead':90C 'linux':1A,25B 'linux-kernel':24B 'local':10A,55B,92C 'logic':30B,83C 'need':100C,105C 'normal':58B 'path':41B 'pkvm':27B,45B 'possibl':76C 'private/google-modules/iommu/arm-smmu-v3/drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c':72C 'privileg':11A,66B,95C,99C 'right':60B 'runtim':28B 'smmu':3A,22B,35B,42B,68C 'use':6A,51B,62B,77C 'use-after-fre':5A,50B 'user':56B,97C,101C 'v3':23B,36B","nicknames":[],"mitigations":[],"who_affected":"Only systems running the Google pKVM build of the Arm SMMU v3 driver are described; the sources do not list affected kernel versions or configurations. Teams running stock kernels or no Arm SMMU hardware with this driver can likely skip it, but the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","armsmmuv3","linuxkernel","pkvm","runtime","unknown"],"campaign_type":null,"search_a":"'-2026':14A,17A '-56944':15A,18A 'allow':9A 'cve':13A,16A 'detach':4A 'escal':12A 'free':8A 'kernel':2A 'linux':1A 'local':10A 'privileg':11A 'smmu':3A 'use':6A 'use-after-fre':5A","search_b":"'android':19B 'arm':21B,34B 'arm-smmu-v3':20B 'build':46B 'caus':48B 'detach':40B,43B 'dev':44B 'devic':39B 'driver':37B 'error':31B 'escal':65B 'execut':59B 'free':53B 'kernel':26B 'linux':25B 'linux-kernel':24B 'local':55B 'logic':30B 'normal':58B 'path':41B 'pkvm':27B,45B 'privileg':66B 'right':60B 'runtim':28B 'smmu':22B,35B,42B 'use':51B,62B 'use-after-fre':50B 'user':56B 'v3':23B,36B","search_c":"'code':87C 'could':89C 'detach':69C 'dev':70C 'due':80C 'error':84C 'escal':93C 'execut':98C 'exploit':107C 'free':79C 'interact':102C 'lead':90C 'local':92C 'logic':83C 'need':100C,105C 'possibl':76C 'private/google-modules/iommu/arm-smmu-v3/drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c':72C 'privileg':95C,99C 'smmu':68C 'use':77C 'user':97C,101C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-56944","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56944","severity":null,"published_at":"2026-11-10T20:19:16+00:00","modified_at":"2026-11-10T20:19:16+00:00","first_seen_at":"2026-11-10T20:46:07+00:00","fetched_at":"2026-11-10T20:46:07+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}