CVE-2026-0133: Android ARM SMMU v3 Privilege Escalation (CVSS 7.8)

Technical summary

The vulnerability resides in the smmu_attach_dev function of arm-smmu-v3.c, where insufficient authorization validation permits unauthorized signing of Android Runtime bootclass artifacts. The missing permission check (CWE-862: Missing Authorization) allows a local process running with standard user privileges to manipulate bootclass components during SMMU attachment operations. The attack chain does not require elevated initial privileges, making it accessible to any local user on an affected device.

Business impact

For Android device users and enterprises deploying Android systems, this vulnerability represents a critical integrity and confidentiality risk. An attacker exploiting this flaw can gain root-equivalent access, potentially exfiltrating sensitive data, installing persistent malware, tampering with system behavior, or compromising device security for all users. Organizations managing fleets of Android devices face potential wholesale compromise if updates are not applied promptly. The lack of required user interaction increases business risk significantly—compromise can occur silently.

Affected systems

Google Android is affected. The vulnerability is rooted in the ARM SMMU v3 driver component (arm-smmu-v3.c), which is used across a wide range of Android devices powered by ARM processors. The exact affected Android versions and patch timeline should be verified against Google's official Android Security & Privacy Year in Review or monthly security bulletin.

Exploitability

Exploitability is straightforward: the attack requires only local code execution with standard user privileges and no special system configuration. The absence of required user interaction, combined with a permissionless code path, makes this vulnerability highly practical to exploit. Any application or process running on the device—including third-party apps—can potentially trigger this condition, provided they can access the relevant kernel interface.

Remediation

Patch deployment is essential and urgent. Users and administrators must apply the Android security update addressing CVE-2026-0133 to all affected devices as soon as available. Given the HIGH severity and ease of exploitation, this should be prioritized above routine updates. Device manufacturers should coordinate closely with Google to ensure patch availability across supported device models. Until patching is complete, treat affected systems as at elevated risk for unauthorized privilege escalation.

Patch guidance

Monitor Google's official Android Security & Privacy bulletin and your device manufacturer's security updates for patches addressing CVE-2026-0133. When available, apply patches immediately across all affected devices—do not delay or defer this update. If your organization manages Android devices, establish a rapid deployment process for critical kernel security fixes. Verify patch installation by confirming the security patch date or checking kernel version information post-update.

Detection guidance

Detection of active exploitation is challenging without kernel-level monitoring. Organizations should look for anomalous privilege escalation events in system logs, unexpected root-owned processes spawned from user applications, or unusual SMMU/kernel driver interactions. Implement kernel integrity monitoring and enforce Security Enhanced Linux (SELinux) policies restrictively to reduce the attack surface. Behavioral analytics detecting unauthorized privilege assumption may surface exploitation attempts.

Why prioritize this

This vulnerability merits immediate priority due to the HIGH CVSS score (7.8), the ease of local exploitation, the absence of user interaction requirements, and the complete confidentiality, integrity, and availability impact on affected systems. The presence of a missing authorization check in kernel code that can be triggered by unprivileged users makes this a textbook privilege escalation risk. Any delay in patching leaves devices vulnerable to compromise by malicious applications or local attackers.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: (1) Local attack vector requiring prior device access; (2) Low attack complexity—no special conditions or race conditions; (3) Low privilege requirements—standard user permissions suffice; (4) No user interaction needed; (5) Unchanged scope; and (6) High impact across confidentiality, integrity, and availability. The missing authorization check (CWE-862) and the ability to sign bootclass artifacts without proper gates elevates risk significantly in a mobile environment where privilege separation is a foundational security model.

Frequently asked questions