CVE-2026-64166: firmware: arm_ffa: Check for NULL FF-A ID table while driver registration
Published Jul 19, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
firmware: armffa: Check for NULL FF-A ID table while driver registration
The bus match callback assumes that every FF-A driver provides an idtable and dereferences it unconditionally. Enforce that contract at registration time so a buggy client driver cannot crash the bus during match.
Affected Software
18 affected components
Linux Linux kernel
Linux Linux kernel>=5.14.1<5.15.209
Linux Linux kernel>=5.16<6.1.175
Linux Linux kernel>=6.2<6.6.142
Linux Linux kernel>=6.7<6.12.92
Linux Linux kernel>=6.13<6.18.34
Linux Linux kernel>=6.19<7.0.11
Linux Linux kernel=5.14
Linux Linux kernel=5.14-rc2
Linux Linux kernel=5.14-rc3
Linux Linux kernel=5.14-rc4
Linux Linux kernel=5.14-rc5
Linux Linux kernel=5.14-rc6
Linux Linux kernel=5.14-rc7
Linux Linux kernel=7.1-rc1
Linux Linux kernel=7.1-rc2
Linux Linux kernel=7.1-rc3
Linux Linux kernel=7.1-rc4
Remediation
Event History
Jul 19, 2026
CVE Published
via MITRE·03:40 PM
Data Sourced
via MITRE·03:40 PM
Description
Data Sourced
via NVD·04:17 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-64166?
The severity of CVE-2026-64166 is rated as 27.
2
How do I fix CVE-2026-64166?
To fix CVE-2026-64166, ensure that FF-A drivers provide a non-null id_table during registration.
3
What systems are affected by CVE-2026-64166?
CVE-2026-64166 affects the Linux kernel implementations that utilize the firmware arm_ffa.
4
What is the impact of CVE-2026-64166?
The impact of CVE-2026-64166 can lead to potential crashes or instability during driver registration.
5
When was CVE-2026-64166 published?
CVE-2026-64166 was published on July 19, 2026.