CVE-2026-0133: In smmu_attach_dev of arm-smmu-v3

Synopsis

This is a missing permission check vulnerability in the ARM SMMU v3 driver (smmu_attach_dev in arm-smmu-v3.c) in the Android kernel. An attacker with a local shell and low-privilege account can exploit the flaw without any user interaction, allowing them to sign malicious Android Runtime bootclass artifacts. Successful exploitation leads to local escalation of privilege, giving the attacker elevated control over the affected device. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the device is required to trigger the flaw.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no administrative or elevated credentials are needed before exploitation.

• Victim interactionNot required

  No user action, click, or social-engineering step is required; the attacker can exploit the flaw entirely on their own.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions or specific memory-layout requirements must be satisfied.

Blast Radius

• A successful attacker signs malicious Android Runtime bootclass artifacts, allowing persistent tampered code to run as part of the trusted boot environment.
• The attacker reads sensitive data accessible at elevated privilege, including credentials, tokens, and protected application data stored on the device.
• The attacker modifies system files, persisted configurations, and trusted class hierarchies that govern runtime behavior across the device.
• Full confidentiality, integrity, and availability of the affected Android kernel environment are compromised, meaning the device should be treated as untrustworthy until remediated.