CVE-2026-64520: firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies
Published Jul 25, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
Affected Software
2 affected componentsFixes available
Linux Linux kernel
debian/linux<=6.12.94-1, <=6.12.101-1
5.10.223-15.10.262-16.1.176-16.1.180-17.1.7-17.1.8-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 7.1.7-1Fixed in 7.1.8-1
Event History
Jul 25, 2026
CVE Published
via MITRE·09:14 AM
Data Sourced
via MITRE·09:14 AM
DescriptionSeverity
Data Sourced
via NVD·10:17 AM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2026-64520?
CVE-2026-64520 has a risk score of 36, indicating a moderate severity level.
2
How do I fix CVE-2026-64520?
To fix CVE-2026-64520, update the Linux kernel to the latest version that addresses this vulnerability.
3
What systems are affected by CVE-2026-64520?
CVE-2026-64520 affects systems running the vulnerable versions of the Linux kernel that utilize the arm_ffa firmware.
4
What are the consequences of not addressing CVE-2026-64520?
Failing to address CVE-2026-64520 may lead to potential unauthorized access to partition descriptors and associated data.
5
When was CVE-2026-64520 published?
CVE-2026-64520 was published on July 25, 2026.