CVE-2026-68400: firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation
In the Linux kernel, the following vulnerability has been resolved:
firmware: armffa: Fix Endpoint Memory Access Descriptor offset calculation
Use the descriptor's epmemoffset to calculate the start of the endpoint memory access array and to comply with the FF-A spec instead of defaulting to sizeof(struct ffamemregion). This requires moving ffamemregionadditionalsetup() earlier in the setup flow. Also, add sanity checks to ensure the calculated descriptor offsets do not exceed maxfragsize.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Compensating control
In the Linux kernel arm_ffa firmware handling, calculate the endpoint memory access array start using the descriptor's ep_mem_offset rather than sizeof(struct ffa_mem_region), move ffa_mem_region_additional_setup() earlier in the setup flow, and add sanity checks ensuring calculated descriptor offsets do not exceed max_fragsize.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68400?
CVE-2026-68400 has a risk score of 17, indicating a low severity vulnerability.
How do I fix CVE-2026-68400?
To address CVE-2026-68400, update your Linux kernel to the latest version where this vulnerability is resolved.
What systems are affected by CVE-2026-68400?
CVE-2026-68400 affects systems running vulnerable versions of the Linux kernel that implement the firmware ARM FF-A specification.
Is CVE-2026-68400 exploitable?
CVE-2026-68400 has the potential to be exploited, which could impact the integrity of endpoint memory access in affected systems.
What is the main issue addressed in CVE-2026-68400?
CVE-2026-68400 resolves a vulnerability in the Linux kernel related to incorrect calculations of Endpoint Memory Access Descriptor offsets.