CVE-2026-64081: firmware: arm_ffa: Validate framework notification message layout
In the Linux kernel, the following vulnerability has been resolved:
firmware: armffa: Validate framework notification message layout
Framework notifications carry an indirect message in the shared RX buffer. Validate the reported offset and size before using them, reject zero-length payloads, and ensure that any non-header payload starts at the UUID field rather than in the middle of the message header.
Use the validated offset and size values for both kmemdup() and the UUID parsing path so malformed firmware data cannot drive an out-of-bounds read or an oversized allocation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the firmware notification parsing path, validate the reported offset and size before using them for both kmemdup() and the UUID, ensuring malformed firmware data cannot cause out-of-bounds reads or oversized allocations; parse the UUID using the validated layout rather than reading it from the middle of the message header.
Linux kernel (firmware: arm_ffa framework notification parsing) Use validated offset and size for kmemdup() and UUID; validate reported offset/size before use; reject malformed firmware data = enforce_validation
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
The issue is triggered when the kernel processes a malformed framework notification whose indirect message in the shared RX buffer reports an invalid offset or size. The vulnerable processing could use that firmware-provided data for an out-of-bounds read or an oversized allocation.
Is local access or authentication required to exploit it?
The supplied CVSS vector rates the attack vector as local and lists no privileges or user interaction requirements. The available data does not specify how an attacker would cause malicious firmware notification data to be delivered.
What should be checked to determine whether a system is exposed?
Identify systems running the Linux kernel that use Arm FF-A firmware notifications with indirect messages in the shared RX buffer. Then verify whether the installed kernel includes one of the referenced stable fixes; no affected or fixed version numbers are provided.