CVE-2026-68401
High · 7.8CVSS
7.8
EPSS
0.1%
Published
Aug 10, 2026
CISA due date
—
Cloudanix analysis
A bug in the Linux kernel's handling of certain low-level firmware messages on ARM systems could let someone with local access take over the entire machine.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Low
- Impact
- Privilege Gain
- Component
- OS kernel
- Class
- Buffer Overflow
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Out-of-bounds writes in ffa_setup_and_transmit() when ep_mem_access->reserved or constituents are written using sizes calculated for FFA version 1.2 on older versions, or when buffer space for constituents is insufficient.
Why it matters to the business
Local attackers on Linux systems using the ARM FF-A firmware interface can corrupt kernel memory, leading to crashes, privilege escalation, or arbitrary code execution in the kernel.
How an attack unfolds
A local attacker triggers the vulnerable path in the arm_ffa driver by issuing FFA setup and transmit operations that rely on version-dependent structure sizes, causing writes beyond allocated memory and allowing kernel memory corruption.
How to fix it
Update the Linux kernel to a version containing the fix that memsets the structure to zero based on the actual FFA version and verifies sufficient space before writing constituents; rebuild and reboot with the patched kernel.
How to confirm the fix worked
Confirm the patch is applied by inspecting the arm_ffa driver source for version-aware memset and size checks; run kernel self-tests or fuzzing targeting FFA version < 1.2 paths to verify no OOB writes occur.
Typical attack path
- Obtain local user access on an affected Linux system
- Interact with the arm_ffa interface to invoke ffa_setup_and_transmit()
- Supply parameters that cause size miscalculations for FFA versions < 1.2
- Trigger out-of-bounds writes to corrupt kernel structures
- Leverage corruption for privilege escalation or denial of service
How to detect it
Review kernel logs and dmesg for arm_ffa related oops or warnings; audit processes making calls into the FFA subsystem; inspect for unexpected memory corruption indicators in kernel crash dumps.
What your security team should do
- Prioritize kernel updates on all systems exposing the arm_ffa driver
- Restrict unprivileged access to firmware interfaces where feasible
- Enable kernel hardening features such as KASAN during testing
- Monitor for local privilege-escalation attempts targeting kernel drivers
The record
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() Sashiko (locally) reports multiple out-of-bound issues in ffa_setup_and_transmit: 1) Writing ep_mem_access->reserved can write out of bounds for FFA versions < 1.2 as ffa_emad_size_get() returns 16 bytes in that case while reserved has an offset of 24. Instead of zeroing fields, memset the struct to zero first based on the FFA version. 2) Make sure there is enough size to write constituents. While at it, convert the only sizeof() in the driver that uses a type instead of variable.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|