CVE-2026-64520

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Bound PARTITIONINFOGETREGS copies The register-based PARTITIONINFOGET path trusted the firmware-provided indices when copying partition descriptors into the caller buffer. Reject inconsistent counts or index...

CVE-2026-64520

In the Linux kernel, the ARM Firmware Framework Architecture (arm_ffa) PARTITION_INFO_GET_REGS path incorrectly trusted firmware-provided indices when copying partition descriptors into the caller buffer. The copy loop could write beyond the allocated array when counts/index progressions were inc...

SUSE CVE-2026-64080

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Snapshot notifier callbacks under lock Both notification handlers currently look up a notifier callback under notifylock, drop the lock, and then dereference the returned notifier entry. A concurrent unregister...

Linux Distros Unpatched Vulnerability : CVE-2026-64166

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - firmware: armffa: Check for NULL FF-A ID table while driver registration The bus match callback assumes that every FF-A driver provides an idtable and...

Linux Distros Unpatched Vulnerability : CVE-2026-64081

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Validate framework notification message layout Framework notifications car...

CVE-2026-64080

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Snapshot notifier callbacks under lock Both notification handlers currently look up a notifier callback under notifylock, drop the lock, and then dereference the returned notifier entry. A concurrent unregister...

CVE-2026-64166

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Check for NULL FF-A ID table while driver registration The bus match callback assumes that every FF-A driver provides an idtable and dereferences it unconditionally. Enforce that contract at registration time so...

CVE-2026-64081

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Validate framework notification message layout Framework notifications carry an indirect message in the shared RX buffer. Validate the reported offset and size before using them, reject zero-length payloads, and...

EUVD-2026-45654

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Validate framework notification message layout Framework notifications carry an indirect message in the shared RX buffer. Validate the reported offset and size before using them, reject zero-length payloads, and...

EUVD-2026-45653

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Snapshot notifier callbacks under lock Both notification handlers currently look up a notifier callback under notifylock, drop the lock, and then dereference the returned notifier entry. A concurrent unregister...

PT-2026-61398

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the arm ffa firmware component where framework notification messages in the shared RX buffer are not properly validated. Specifically, the system fails to verify the...

PT-2026-61397

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the arm ffa firmware component. The notification handlers retrieve a notifier callback while holding the notify lock, but release the lock before...

CVE-2026-45702

A flaw was found in OP-TEE OS, a Trusted Execution Environment TEE for Arm Cortex-A cores. A type confusion vulnerability exists when OP-TEE OS processes an FFAMEMSHARE request from the normal world. This flaw can be exploited by a local attacker with high privileges when OP-TEE is configured as ...

CVE-2026-45702

OP-TEE OS contains a type confusion in the SPMC tmem path when processing an FFA_MEM_SHARE request, affecting 4.3.0 through prior to 4.11.0 for systems configured with CFG_CORE_SEL1_SPMC=y and CFG_SECURE_PARTITION=y. This can impact availability (kernel/OP-TEE stability) with no reported confiden...

Linux Distros Unpatched Vulnerability : CVE-2026-45702

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OP-TEE is a Trusted Execution Environment TEE designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Firmware: armffa: Check if ffadriverremove is present before executing it. Currently, ffadrv-remove is called unconditionally from ffadeviceremove. Since the driver registration does not check for this, and allows it to be...

CVE-2026-0037

In multiple functions of ffa.c, there is a possible memory corruption due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

ASB-A-439862698

In doffamemxfer of ffa.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Firmware: armffa – Set dmamask for FFA devices. Setting dmamask for FFA devices is necessary; otherwise, DMA allocation using the device pointer may lead to the following warning: WARNING: CPU: 1, PID: 1, at...

Azure Linux 3.0 Security Update: kernel (CVE-2025-38043)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-38043 advisory. - In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Set dmamask for ffa...