CVE-2026-68401: firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit()
In the Linux kernel, the following vulnerability has been resolved:
firmware: armffa: Fix out-of-bound writes in ffasetupandtransmit()
Sashiko (locally) reports multiple out-of-bound issues in ffasetupandtransmit: 1) Writing epmemaccess->reserved can write out of bounds for FFA versions < 1.2 as ffaemadsizeget() returns 16 bytes in that case while reserved has an offset of 24. Instead of zeroing fields, memset the struct to zero first based on the FFA version.
2) Make sure there is enough size to write constituents.
While at it, convert the only sizeof() in the driver that uses a type instead of variable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
firmware: arm_ffato a version that resolves this vulnerability.Patch Fix out-of-bound writes in ffa_setup_and_transmit() - Configuration
In the ffa_setup_and_transmit() driver path, memset the struct to zero first (instead of only zeroing individual fields) based on the correct struct size to prevent out-of-bounds writes.
Linux kernel (FFA driver) memset struct before use = memset(struct, 0, sizeof(struct)) - Configuration
Ensure the allocated/written buffer size is sufficient for the EMAD constituents in ffa_setup_and_transmit(); specifically, for FFA versions < 1.2 where ffa_emad_size_get() returns 16 bytes while reserved has an offset of 24, allocate a larger buffer to cover the reserved offset.
Linux kernel (ffa_setup_and_transmit) buffer size for ffa_emad_size_get() = Use enough size to write constituents; handle versions < 1.2 (ffa_emad_size_get() returns 16 bytes) vs reserved offset 24 bytes - Configuration
In the ffa_setup_and_transmit() driver code, convert the only sizeof() usage that currently uses a variable type to use the struct type instead.
Linux kernel (FFA driver) sizeof usage = Use the fixed struct type size instead of variable
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68401?
The severity of CVE-2026-68401 is rated as 34, indicating a moderate risk.
How do I fix CVE-2026-68401?
To fix CVE-2026-68401, ensure your Linux kernel is updated to the latest version that includes the patch for this vulnerability.
What systems are affected by CVE-2026-68401?
CVE-2026-68401 affects systems running vulnerable versions of the Linux kernel with the arm_ffa component.
What type of vulnerability is CVE-2026-68401?
CVE-2026-68401 is an out-of-bounds write vulnerability occurring in the ffa_setup_and_transmit function.
Is CVE-2026-68401 locally exploitation possible?
Yes, CVE-2026-68401 can be exploited locally due to the ability to write out of bounds in specific firmware scenarios.