CVE-2026-0027: Linux Kernel Android - Critical Out of Bounds Write Vulnerability
Summary
CVE-2026-0027: In smmu_detach_dev of arm-smmu-v3.c, there is a possible out of bounds write due to a use after free. Affects :linux_kernel: versions >= :0, < :2026-03-05. Fixed in :2026-03-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Android operating system, responsible for managing hardware resources and providing essential services to applications. It is designed to be efficient, secure, and stable, supporting a wide range of devices. However, vulnerabilities can arise due to complex interactions within the kernel, potentially leading to severe security risks.
Vulnerability Detail
In the function smmu_detach_dev of arm-smmu-v3.c, there exists a critical vulnerability characterized by a possible out of bounds write due to a use after free condition. This flaw can allow local attackers to escalate their privileges, gaining system execution rights without requiring user interaction. The vulnerability is particularly concerning as it can compromise the integrity and security of the entire system.
How To Fix
Minimum fixed version
:2026-03-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is strongly recommended to apply the patch as soon as it becomes available to mitigate the risk.
Conclusion
The CVE-2026-0027 vulnerability poses a significant risk to the Linux Kernel in Android systems, allowing local privilege escalation through a critical out of bounds write. Immediate action is required to update the kernel to the patched version to ensure system security.
See every vulnerability recorded for :linux_kernel: →
FAQ
CVE-2026-0027 is a critical vulnerability in the Linux Kernel for Android that allows for a possible out of bounds write due to a use after free condition.
An attacker with local access can exploit this vulnerability to escalate their privileges, potentially compromising the entire system.
No, user interaction is not needed for exploitation, making it particularly dangerous.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
While there are no specific workarounds, it is crucial to monitor for updates and apply the patch as soon as it is available to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for :linux_kernel:.
