Linux kernel arm_ffa: unvalidated notification layout drives out-of-bounds read of the shared RX buffer

Impact

Arm FF-A framework notifications carry an indirect message in the RX buffer shared with the secure world, and the driver used the reported offset and size without checking them. Malformed values could drive an out-of-bounds read or an oversized kmemdup() allocation in the host kernel, and a non-header payload could be made to start in the middle of the message header. This sits on the boundary between the secure partition manager and the normal-world kernel, so it matters on Arm64 GPU hosts (Grace-class and other Arm servers); x86 fleets do not build this driver at all. NVD scores it 8.4 with a local vector, but the record describes no path from a tenant workload - the data has to come from the firmware side.

Who can reach it

Local, and only on platforms that expose Arm FF-A: whoever controls the secure-world firmware writing messages into the shared RX buffer. No network path and no described route from an unprivileged tenant pod; authentication is not the relevant boundary here, firmware trust is.

What to do

Take the stable kernel fix (the three linked commits), which validates offset and size before both the kmemdup() and the UUID parsing path. It is a kernel change, so it means drain and reboot each affected Arm node onto a patched kernel. The record names no fixed release version and no vendor mitigation - track your distribution's stable backport.

References

Related entries

• Linux kernel (arch/x86/kvm): A nested guest can put an out-of-range virtual-processor ID into an enlightened VMCS andCVE-2026-64247 · Linux kernel (arch/x86/kvm)High
• Linux kernel sockmap: integer overflow in bpf_msg_push_data allocation leads to out-of-bounds memcpyCVE-2026-64548 · Linux kernel bpf sockmap (bpf_msg_push_data copy+len integer overflow)High
• Linux kernel virtio-net: loose length check in receive_big() lets a malicious backend write past the frag arrayCVE-2026-64552 · Linux kernel virtio-net (receive_big() length validation)High
• Linux kernel sockmap: 32-bit wrap in bpf_msg_pop_data bounds check runs the pop loop off the scatterlistCVE-2026-74256 · Linux kernel bpf sockmap (bpf_msg_pop_data bounds check overflow)High
• Linux kernel io_uring: per-task restrictions are freed across exec, so post-exec rings are unrestrictedCVE-2026-80713 · Linux kernel io_uring (per-task restrictions dropped on exec)High
• Linux kernel qla2xxx: MSI-X vector count truncates to zero and the driver dereferences ZERO_SIZE_PTRCVE-2026-89856 · Linux kernel qla2xxx (MSI-X derived queue counts)High