ASB-A-456069704

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-456069704.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-456069704
Aliases
  • A-456069704
  • CVE-2026-0027
Published
2026-03-01T00:00:00Z
Modified
2026-04-17T15:55:28.020024Z
Summary
[none]
Details

In smmudetachdev of arm-smmu-v3.c, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / :linux_kernel:

Package

Name
:linux_kernel:

Affected ranges

Type
ECOSYSTEM
Events
Introduced
:0
Fixed
:2026-03-05

Affected versions

Other
Kernel

Ecosystem specific 

{
    "vanir_signatures": [
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "288654694134439000981061017360040645837",
                    "133771461951290131703131364193993208629",
                    "183548860584846842528520461273196722804",
                    "95512098675726544049912100789255527581",
                    "70777923933772038924005633180504681566",
                    "71988035598196023299876578053717287410",
                    "325948933568175716578226504831880202921",
                    "57420259009255204958750246863398351412",
                    "34526196861802799825472308532122284250",
                    "213047514036668222729306222888309982502",
                    "93199950731325579439049880958622484407",
                    "107087150406060863735802002644888670214",
                    "329817719699874049480378743693481918821",
                    "227624341510737526114087378828803381033",
                    "66191013663877768225848222760591250389",
                    "114840158270320240612471525773689473985",
                    "293607298622799903067012174794091941193",
                    "216368109786315037334154872707629888783",
                    "84085390483685711329387602508134772061"
                ]
            },
            "id": "ASB-A-456069704-05532b67",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Line",
            "source": "https://android.googlesource.com/kernel/common/+/3af14d2057f2f3df97472cef6b293113b020d1e6",
            "target": {
                "file": "drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c"
            }
        },
        {
            "digest": {
                "length": 2128.0,
                "function_hash": "122899801202197046774928084325131962677"
            },
            "id": "ASB-A-456069704-3be60a07",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Function",
            "source": "https://android.googlesource.com/kernel/common/+/5161b3e75fb025bb4ebb11fbf1ac037021e56719",
            "target": {
                "function": "smmu_detach_dev",
                "file": "drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c"
            }
        },
        {
            "digest": {
                "length": 1530.0,
                "function_hash": "55630652615229756518138902375658794234"
            },
            "id": "ASB-A-456069704-5c05fad6",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Function",
            "source": "https://android.googlesource.com/kernel/common/+/a47e0e78ad5b4e153b40fc1c9def11991aa6ca0c",
            "target": {
                "function": "smmu_detach_dev",
                "file": "drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c"
            }
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "288654694134439000981061017360040645837",
                    "282870674852765733926616292185349644607",
                    "232215569679108171305925228221872467943",
                    "247060813753231364660575661585867723311",
                    "209295399459148008550765395133198809591",
                    "326036224632842123327458064643613035161",
                    "253002257614027207949366627810927374069",
                    "7224185012321003250160961334978509682",
                    "156870374492832018948013132847797158178",
                    "338712742102495046267608985017147196576",
                    "196149664619217120952557774627423285113",
                    "339096221259219212341823746163829763402",
                    "329817719699874049480378743693481918821",
                    "45294402756749353943189431178237428729",
                    "16754931949423100060617494970875184126",
                    "43153239174961493055346654007913313438",
                    "182506939725670209041777632957011766591",
                    "300585027477329659270742436541483319512",
                    "22916508942463824415580596051118813807"
                ]
            },
            "id": "ASB-A-456069704-7a13e6fe",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Line",
            "source": "https://android.googlesource.com/kernel/common/+/a47e0e78ad5b4e153b40fc1c9def11991aa6ca0c",
            "target": {
                "file": "drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c"
            }
        },
        {
            "digest": {
                "length": 1598.0,
                "function_hash": "313158357570969380583111686952021272008"
            },
            "id": "ASB-A-456069704-8192c6dd",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Function",
            "source": "https://android.googlesource.com/kernel/common/+/3af14d2057f2f3df97472cef6b293113b020d1e6",
            "target": {
                "function": "smmu_detach_dev",
                "file": "drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c"
            }
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "288654694134439000981061017360040645837",
                    "97285175887401810975915610629688764100",
                    "281165519712473669271393015025326339852",
                    "192648665819411282187285758902347671722",
                    "236710763030857480361568327792302567266",
                    "127886335638606218788966038377478738871",
                    "196149664619217120952557774627423285113",
                    "298508464915705825433744784768395772176",
                    "240842646966908932270709054536146126289",
                    "201723186965140441067284865168750712622",
                    "208693715743010595810950457509981541070"
                ]
            },
            "id": "ASB-A-456069704-d4853275",
            "deprecated": false,
            "signature_version": "v1",
            "signature_type": "Line",
            "source": "https://android.googlesource.com/kernel/common/+/5161b3e75fb025bb4ebb11fbf1ac037021e56719",
            "target": {
                "file": "drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c"
            }
        }
    ],
    "fixes": [
        "https://android.googlesource.com/kernel/common/+/3af14d2057f2f3df97472cef6b293113b020d1e6",
        "https://android.googlesource.com/kernel/common/+/a47e0e78ad5b4e153b40fc1c9def11991aa6ca0c",
        "https://android.googlesource.com/kernel/common/+/5161b3e75fb025bb4ebb11fbf1ac037021e56719"
    ],
    "types": [
        "EoP"
    ],
    "spl": "2026-03-05",
    "severity": "Critical"
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-456069704.json"