In arm_lpae_split_blk_unmap of io-pgtable-arm-common.c, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"fixes": [
"https://android.googlesource.com/kernel/common/+/82cd807f41d89d5cf2b4c3ac7affdb91188baea7"
],
"severity": "High",
"spl": "2026-11-05",
"types": [
"EoP"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"line_hashes": [
"78200546156012581065005364508826195945",
"219870121190120044095832161766145461143",
"87878553870752821017494372189761903754",
"260139003182918249110250837991220553498"
],
"threshold": 0.9
},
"id": "ASB-A-503379315-55d19712",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/82cd807f41d89d5cf2b4c3ac7affdb91188baea7",
"target": {
"file": "drivers/iommu/io-pgtable-arm-common.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "68851789192442681393706024052447704706",
"length": 1034
},
"id": "ASB-A-503379315-ea165146",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/82cd807f41d89d5cf2b4c3ac7affdb91188baea7",
"target": {
"file": "drivers/iommu/io-pgtable-arm-common.c",
"function": "arm_lpae_split_blk_unmap"
}
}
]
}