{"id":"CVE-2026-58809","kind":"vulnerability","aliases":["CVE-2026-58809"],"related":[],"title":"Linux arm-smmu-v3 driver: missing bounds check allows out-of-bounds write","description":"In smmu_domain_config_s1 of arm-smmu-v3.c, there is a possible OOB Write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.","summary":"A missing bounds check in the smmu_domain_config_s1 function of the arm-smmu-v3 IOMMU driver allows an out-of-bounds write. A local attacker with system-level execution could escalate privileges.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arm64","infrastructure","iommu","linux-kernel"],"not_affected_if":["no-smmuv3-hardware"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:27+00:00","first_seen_at":"2026-11-10T20:46:12+00:00","triaged_at":"2026-11-10T20:50:11+00:00","updated_at":"2026-11-10T20:50:11+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T20:50:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux arm-smmu-v3 driver: missing bounds check allows out-of-bounds write","impact":"high","summary":"A missing bounds check in the smmu_domain_config_s1 function of the arm-smmu-v3 IOMMU driver allows an out-of-bounds write. A local attacker with system-level execution could escalate privileges.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","arm64","iommu"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user escalates to kernel-level privileges","analyst_note":"Check the kernel.org or NVD CPE ranges and the upstream fix commit for arm-smmu-v3.c to name affected and fixed kernel versions.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-smmuv3-hardware"],"who_is_affected":"Systems running a kernel with the arm-smmu-v3 driver (ARM systems using an SMMUv3 IOMMU) are in scope. The sources do not list affected kernel versions or whether the driver is built in by default. Systems without ARM SMMUv3 hardware are likely unaffected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000697,"input_tokens":4536,"output_tokens":487,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-58809':18A,21A 'allow':10A,47B 'arm':3A,42B,72C 'arm-smmu-v3':2A,41B,71C 'arm64':22B 'attack':56B 'bound':8A,14A,30B,52B,86C 'c':75C 'check':9A,31B,87C 'config':36B,68C 'could':62B,89C 'cve':16A,19A 'domain':35B,67C 'driver':6A,46B 'due':82C 'escal':63B,93C 'execut':61B,98C 'exploit':107C 'function':38B 'infrastructur':23B 'interact':102C 'iommu':24B,45B 'kernel':27B 'lead':90C 'level':60B 'linux':1A,26B 'linux-kernel':25B 'local':55B,92C 'miss':7A,29B,85C 'need':100C,105C 'oob':80C 'out-of-bound':11A,49B 'possibl':79C 'privileg':64B,95C,99C 's1':37B,69C 'smmu':4A,34B,43B,66C,73C 'system':59B,97C 'system-level':58B 'user':101C 'v3':5A,44B,74C 'write':15A,53B,81C","nicknames":[],"mitigations":[],"who_affected":"Systems running a kernel with the arm-smmu-v3 driver (ARM systems using an SMMUv3 IOMMU) are in scope. The sources do not list affected kernel versions or whether the driver is built in by default. Systems without ARM SMMUv3 hardware are likely unaffected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["arm64","infrastructure","iommu","linuxkernel","unknown"],"campaign_type":null,"search_a":"'-2026':17A,20A '-58809':18A,21A 'allow':10A 'arm':3A 'arm-smmu-v3':2A 'bound':8A,14A 'check':9A 'cve':16A,19A 'driver':6A 'linux':1A 'miss':7A 'out-of-bound':11A 'smmu':4A 'v3':5A 'write':15A","search_b":"'allow':47B 'arm':42B 'arm-smmu-v3':41B 'arm64':22B 'attack':56B 'bound':30B,52B 'check':31B 'config':36B 'could':62B 'domain':35B 'driver':46B 'escal':63B 'execut':61B 'function':38B 'infrastructur':23B 'iommu':24B,45B 'kernel':27B 'level':60B 'linux':26B 'linux-kernel':25B 'local':55B 'miss':29B 'out-of-bound':49B 'privileg':64B 's1':37B 'smmu':34B,43B 'system':59B 'system-level':58B 'v3':44B 'write':53B","search_c":"'arm':72C 'arm-smmu-v3':71C 'bound':86C 'c':75C 'check':87C 'config':68C 'could':89C 'domain':67C 'due':82C 'escal':93C 'execut':98C 'exploit':107C 'interact':102C 'lead':90C 'local':92C 'miss':85C 'need':100C,105C 'oob':80C 'possibl':79C 'privileg':95C,99C 's1':69C 'smmu':66C,73C 'system':97C 'user':101C 'v3':74C 'write':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58809","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58809","severity":null,"published_at":"2026-11-10T20:19:27+00:00","modified_at":"2026-11-10T20:19:27+00:00","first_seen_at":"2026-11-10T20:46:12+00:00","fetched_at":"2026-11-10T20:46:12+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}