CVE-2026-68400

What it actually does

Incorrect use of sizeof(struct ffa_mem_region) instead of the descriptor's ep_mem_offset for locating the endpoint memory access array in arm_ffa leads to wrong pointer arithmetic and potential out-of-bounds reads/writes when handling FF-A memory regions.

Why it matters to the business

Local attackers on affected Linux systems may corrupt kernel memory, enabling privilege escalation, denial of service, or arbitrary code execution within the kernel.

How an attack unfolds

An attacker with local access supplies crafted FF-A memory region descriptors through user-space interfaces; the driver miscalculates the array start, allowing the attacker to read or write beyond intended bounds during region setup and additional_setup calls.

How to fix it

Apply the upstream kernel patch that moves ffa_mem_region_additional_setup earlier, uses ep_mem_offset for array location, and adds max_fragsize bounds checks; rebuild and deploy updated kernels or distribution packages containing the fix.

How to confirm the fix worked

Confirm the corrected offset logic and sanity checks are present in the arm_ffa source; test with valid and boundary-case FF-A descriptors to ensure offsets stay within max_fragsize.

Typical attack path

1. Obtain local user access on a Linux system using the vulnerable arm_ffa driver
2. Invoke FF-A memory sharing or donation operations via the driver interface
3. Provide malicious memory region descriptors that trigger the offset miscalculation
4. Leverage resulting out-of-bounds access to corrupt kernel structures and escalate privileges

How to detect it

Inspect kernel logs and crash dumps for arm_ffa or ffa_mem_region related faults, out-of-bounds accesses, or unexpected descriptor handling errors; correlate with processes invoking FF-A memory operations.

What your security team should do

• Prioritize kernel updates for systems exposing arm_ffa interfaces
• Limit local unprivileged access where feasible until patched
• Review kernel logs for arm_ffa related oops or corruption warnings