{"id":"ASB-A-456069704","details":"In smmu_detach_dev of arm-smmu-v3.c, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-456069704","CVE-2026-0027"],"modified":"2026-04-17T15:55:28.020024Z","published":"2026-03-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-03-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/3af14d2057f2f3df97472cef6b293113b020d1e6"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/a47e0e78ad5b4e153b40fc1c9def11991aa6ca0c"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/5161b3e75fb025bb4ebb11fbf1ac037021e56719"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2026-03-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"spl":"2026-03-05","vanir_signatures":[{"signature_version":"v1","signature_type":"Line","id":"ASB-A-456069704-05532b67","source":"https://android.googlesource.com/kernel/common/+/3af14d2057f2f3df97472cef6b293113b020d1e6","deprecated":false,"digest":{"threshold":0.9,"line_hashes":["288654694134439000981061017360040645837","133771461951290131703131364193993208629","183548860584846842528520461273196722804","95512098675726544049912100789255527581","70777923933772038924005633180504681566","71988035598196023299876578053717287410","325948933568175716578226504831880202921","57420259009255204958750246863398351412","34526196861802799825472308532122284250","213047514036668222729306222888309982502","93199950731325579439049880958622484407","107087150406060863735802002644888670214","329817719699874049480378743693481918821","227624341510737526114087378828803381033","66191013663877768225848222760591250389","114840158270320240612471525773689473985","293607298622799903067012174794091941193","216368109786315037334154872707629888783","84085390483685711329387602508134772061"]},"target":{"file":"drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c"}},{"signature_version":"v1","signature_type":"Function","id":"ASB-A-456069704-3be60a07","source":"https://android.googlesource.com/kernel/common/+/5161b3e75fb025bb4ebb11fbf1ac037021e56719","deprecated":false,"digest":{"function_hash":"122899801202197046774928084325131962677","length":2128},"target":{"file":"drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c","function":"smmu_detach_dev"}},{"signature_version":"v1","signature_type":"Function","id":"ASB-A-456069704-5c05fad6","source":"https://android.googlesource.com/kernel/common/+/a47e0e78ad5b4e153b40fc1c9def11991aa6ca0c","deprecated":false,"digest":{"function_hash":"55630652615229756518138902375658794234","length":1530},"target":{"file":"drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c","function":"smmu_detach_dev"}},{"signature_version":"v1","signature_type":"Line","id":"ASB-A-456069704-7a13e6fe","source":"https://android.googlesource.com/kernel/common/+/a47e0e78ad5b4e153b40fc1c9def11991aa6ca0c","deprecated":false,"digest":{"threshold":0.9,"line_hashes":["288654694134439000981061017360040645837","282870674852765733926616292185349644607","232215569679108171305925228221872467943","247060813753231364660575661585867723311","209295399459148008550765395133198809591","326036224632842123327458064643613035161","253002257614027207949366627810927374069","7224185012321003250160961334978509682","156870374492832018948013132847797158178","338712742102495046267608985017147196576","196149664619217120952557774627423285113","339096221259219212341823746163829763402","329817719699874049480378743693481918821","45294402756749353943189431178237428729","16754931949423100060617494970875184126","43153239174961493055346654007913313438","182506939725670209041777632957011766591","300585027477329659270742436541483319512","22916508942463824415580596051118813807"]},"target":{"file":"drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c"}},{"signature_version":"v1","signature_type":"Function","id":"ASB-A-456069704-8192c6dd","source":"https://android.googlesource.com/kernel/common/+/3af14d2057f2f3df97472cef6b293113b020d1e6","deprecated":false,"digest":{"function_hash":"313158357570969380583111686952021272008","length":1598},"target":{"file":"drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c","function":"smmu_detach_dev"}},{"signature_version":"v1","signature_type":"Line","id":"ASB-A-456069704-d4853275","source":"https://android.googlesource.com/kernel/common/+/5161b3e75fb025bb4ebb11fbf1ac037021e56719","deprecated":false,"digest":{"threshold":0.9,"line_hashes":["288654694134439000981061017360040645837","97285175887401810975915610629688764100","281165519712473669271393015025326339852","192648665819411282187285758902347671722","236710763030857480361568327792302567266","127886335638606218788966038377478738871","196149664619217120952557774627423285113","298508464915705825433744784768395772176","240842646966908932270709054536146126289","201723186965140441067284865168750712622","208693715743010595810950457509981541070"]},"target":{"file":"drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c"}}],"severity":"Critical","fixes":["https://android.googlesource.com/kernel/common/+/3af14d2057f2f3df97472cef6b293113b020d1e6","https://android.googlesource.com/kernel/common/+/a47e0e78ad5b4e153b40fc1c9def11991aa6ca0c","https://android.googlesource.com/kernel/common/+/5161b3e75fb025bb4ebb11fbf1ac037021e56719"],"types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-456069704.json"}}],"schema_version":"1.7.5"}