Linux kernel arm_ffa: out-of-bounds writes when building FF-A memory-sharing descriptors

Impact

The FF-A driver builds its memory-sharing descriptor without accounting for the smaller endpoint-memory-access record used by FF-A versions below 1.2, so zeroing the reserved field writes past the allocated structure, and the constituent array is written without a size check. A local attacker able to drive the FF-A memory-share path corrupts kernel heap memory, which is the usual starting point for local privilege escalation on the host. This matters on Arm-based accelerator hosts (Grace, Ampere and similar) that use FF-A to talk to secure-world partitions; x86 GPU nodes do not load this driver at all, so most fleets are unaffected. The fix memsets the structure according to the negotiated FF-A version and bounds the constituent write.

Who can reach it

Local only, on an Arm host where the arm_ffa driver is loaded and a userspace or in-kernel consumer can reach the FF-A memory-sharing path. Low-privileged local access is enough per the vendor vector (AV:L/PR:L); no remote or network exposure.

What to do

Take the stable-kernel fix (backported across several stable branches - see the git.kernel.org commits) and reboot each affected Arm node. There is no runtime mitigation other than keeping the FF-A driver out of the kernel on platforms that do not need it, so plan a rolling drain-and-reboot across the Arm part of the fleet.

References

Related entries

• Linux kernel mlx5_core MACsec offload: Deleting an offloaded MACsec RX secure channel frees the per-SC metadata_dstCVE-2026-72072 · Linux kernel mlx5_core MACsec offloadHigh
• Linux kernel bpf: fork bailout frees an uninitialized task->bpf_storage, causing UAF or hangCVE-2026-72110 · Linux kernel BPF task local storage (copy_process / free_task bailout)High
• Linux kernel mm: DAX hotplug into an early section leaves ZONE_DEVICE tail struct pages uninitializedCVE-2026-72172 · Linux kernel mm/mm_init (ZONE_DEVICE compound_nr_pages on early sections)High
• Linux kernel (arch/x86/kvm/vmx): The nested vTPR versus TPR-threshold consistency check ran only after KVM had alreadyCVE-2026-72287 · Linux kernel (arch/x86/kvm/vmx)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A use-after-free in the amdkfd (KFD compute driverCVE-2026-72449 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux kernel (net/xfrm): Xfrm_selector_match() compared selectors without checking that the selector family matches theCVE-2026-72450 · Linux kernel (net/xfrm)High