Samsung Vyond CVE-2026-110933

Requires an attacker already executing at RISC-V supervisor (S-mode) privilege capable of invoking the Vyond security monitor's SBI calls - sbi_sm_create_enclave, sbi_sm_destroy_enclave, enter/resume/stop/exit_enclave, or the create/change/share_shm_region operations in tee/monitor/src/api.rs - and supplying input (e.g. invalid create_args, enclave IDs, or shared-memory region parameters) that drives those functions into an error branch. In builds before commit fb10a5c8b833df7f152d4a563a61d6090a1790d7 that error branch calls panic!(), producing an uncaught exception that crashes the monitor. LIMITING FACTORS: local access only (no network vector), high privilege required (PR:H - must be able to issue SBI monitor calls), no user interaction, and availability-only impact with no data exposure; this is not remotely or unauthenticated-exploitable.

This is a genuinely low-priority issue despite being a flaw in a security-critical component (a TEE/enclave security monitor). The provided CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H, base 4.4 MEDIUM) is internally consistent with the source evidence: the fix replaces panic!() calls with graceful error returns (err.to_isize()) in the RISC-V SBI enclave-management functions, so the only impact is availability (A:H) via an uncaught exception - no confidentiality or integrity loss (C:N/I:N). Exploitation requires PR:H (an attacker already running at supervisor/kernel privilege able to issue SBI security-monitor calls) and local access (AV:L), which sharply limits real-world risk. No EPSS score, KEV listing, or POC was provided; exploitation status is 'no public exploit identified at time of analysis.' CONFLICT TO NOTE: the input Tags assert 'Information Disclosure,' but the CVSS vector and CWE-248 (Uncaught Exception) both indicate a denial-of-service/availability problem with C:N - the Information Disclosure tag is not supported by any provided signal and appears mislabeled. Net: a real but low-severity availability bug reachable only by an already-privileged local actor.

An actor already operating at supervisor/kernel privilege on the host issues a Supervisor Binary Interface (SBI) call to the Vyond security monitor - for example sbi_sm_create_enclave or a shared-memory operation - with arguments that trigger an error path. In the unpatched monitor that error path calls panic!(), raising an uncaught exception that crashes the security monitor and halts the system. No public exploit code was identified; the only artifact is the vendor patch commit.