{"id":"CVE-2026-58684","kind":"vulnerability","aliases":["CVE-2026-58684"],"related":[],"title":"Linux SMMU driver: logic error lets local users bypass permissions","description":"In smmu_config_l3tt of smmu.c, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"A logic error in the smmu_config_l3tt function of the ARM SMMU driver (smmu.c) allows a permission bypass. A local user can use it to escalate privileges without extra execution rights and without user interaction.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arm-smmu","infrastructure","kernel","linux"],"not_affected_if":["no-arm-smmu-hardware"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:23+00:00","first_seen_at":"2026-11-10T20:46:09+00:00","triaged_at":"2026-11-10T20:52:00+00:00","updated_at":"2026-11-10T20:52:00+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T20:52:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux SMMU driver: logic error lets local users bypass permissions","impact":"high","summary":"A logic error in the smmu_config_l3tt function of the ARM SMMU driver (smmu.c) allows a permission bypass. A local user can use it to escalate privileges without extra execution rights and without user interaction.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","arm-smmu"],"confidence":0.4,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user escalates to kernel-level privileges","analyst_note":"Find the affected kernel version ranges and fixed commit from the NVD entry or the upstream kernel CVE record for smmu_config_l3tt in drivers/iommu/arm/arm-smmu-v3/smmu.c.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-arm-smmu-hardware"],"who_is_affected":"Systems whose kernel or device stack includes the smmu.c driver for ARM System MMU hardware. The sources do not name affected kernel versions or whether the driver is enabled by default. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000685,"input_tokens":4522,"output_tokens":466,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-58684':13A,16A 'addit':89C 'allow':38B 'arm':18B,34B 'arm-smmu':17B 'bypass':9A,41B,70C 'code':78C 'config':29B,61C 'could':80C 'cve':11A,14A 'driver':3A,36B 'due':71C 'error':5A,25B,75C 'escal':49B,84C 'execut':53B,90C 'exploit':99C 'extra':52B 'function':31B 'infrastructur':20B 'interact':58B,94C 'kernel':21B 'l3tt':30B,62C 'lead':81C 'let':6A 'linux':1A,22B 'local':7A,43B,83C 'logic':4A,24B,74C 'need':92C,97C 'permiss':10A,40B,69C 'possibl':68C 'privileg':50B,86C,91C 'right':54B 'smmu':2A,19B,28B,35B,60C 'smmu.c':37B,64C 'use':46B 'user':8A,44B,57B,93C 'without':51B,56B","nicknames":[],"mitigations":[],"who_affected":"Systems whose kernel or device stack includes the smmu.c driver for ARM System MMU hardware. The sources do not name affected kernel versions or whether the driver is enabled by default. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["armsmmu","infrastructure","kernel","linux","unknown"],"campaign_type":null,"search_a":"'-2026':12A,15A '-58684':13A,16A 'bypass':9A 'cve':11A,14A 'driver':3A 'error':5A 'let':6A 'linux':1A 'local':7A 'logic':4A 'permiss':10A 'smmu':2A 'user':8A","search_b":"'allow':38B 'arm':18B,34B 'arm-smmu':17B 'bypass':41B 'config':29B 'driver':36B 'error':25B 'escal':49B 'execut':53B 'extra':52B 'function':31B 'infrastructur':20B 'interact':58B 'kernel':21B 'l3tt':30B 'linux':22B 'local':43B 'logic':24B 'permiss':40B 'privileg':50B 'right':54B 'smmu':19B,28B,35B 'smmu.c':37B 'use':46B 'user':44B,57B 'without':51B,56B","search_c":"'addit':89C 'bypass':70C 'code':78C 'config':61C 'could':80C 'due':71C 'error':75C 'escal':84C 'execut':90C 'exploit':99C 'interact':94C 'l3tt':62C 'lead':81C 'local':83C 'logic':74C 'need':92C,97C 'permiss':69C 'possibl':68C 'privileg':86C,91C 'smmu':60C 'smmu.c':64C 'user':93C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58684","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58684","severity":null,"published_at":"2026-11-10T20:19:23+00:00","modified_at":"2026-11-10T20:19:23+00:00","first_seen_at":"2026-11-10T20:46:09+00:00","fetched_at":"2026-11-10T20:46:09+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}