CVE-2026-64080: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64080 Overview

CVE-2026-64080 is a use-after-free vulnerability in the Linux kernel's Arm Firmware Framework for Armv8-A (arm_ffa) driver. The flaw exists in the notification handlers within the firmware subsystem, where callbacks are dereferenced after the protecting notify_lock has been released. A concurrent unregister operation can free the notifier entry during this window, causing the handler to access stale memory.

The issue affects both framework and non-framework notification paths in the arm_ffa driver. The kernel maintainers have resolved the flaw by copying the callback pointer and data while notify_lock is held, then invoking the callback after the lock is released.

Critical Impact
Local attackers can trigger a use-after-free condition in kernel memory, potentially leading to privilege escalation, kernel information disclosure, or full system compromise on affected Arm-based Linux systems.

Affected Products

Linux kernel versions containing the arm_ffa firmware driver prior to the fix commits
Arm-based Linux systems using Firmware Framework for Armv8-A (FF-A) notifications
Distributions shipping vulnerable stable kernel branches

Discovery Timeline

2026-07-19 - CVE-2026-64080 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64080

Vulnerability Analysis

The vulnerability resides in the Arm Firmware Framework (FF-A) driver's notification handling logic. Both notification handlers acquire notify_lock, look up a notifier callback entry, release the lock, and then dereference the returned entry to invoke the callback. This ordering creates a Time-of-Check to Time-of-Use (TOCTOU) window.

During the interval between releasing notify_lock and dereferencing the notifier entry, a concurrent unregister operation can remove and free that entry. The handler then dereferences memory that has already been returned to the kernel allocator, resulting in a classic use-after-free [CWE-416].

Because the flaw exists within kernel context, successful exploitation can corrupt kernel data structures or hijack control flow. The Common Vulnerability Scoring System (CVSS) vector indicates a scope change, reflecting that impact extends beyond the vulnerable component into the broader kernel.

Root Cause

The root cause is improper synchronization between the notification handler and the unregister path. The handler assumes the notifier entry remains valid after notify_lock is dropped, but no reference counting or RCU protection extends the entry's lifetime beyond the critical section. Concurrent unregistration violates that implicit lifetime assumption.

Attack Vector

Exploitation requires local access to an affected system and the ability to trigger FF-A notification registration and unregistration concurrently with notification delivery. An attacker who wins the race can cause the kernel to invoke a callback pointer read from freed memory. Depending on kernel allocator behavior, that memory can be reallocated with attacker-controlled contents, enabling arbitrary kernel-mode execution.

The vulnerability manifests in the arm_ffa notification dispatch paths. Refer to the upstream commits for the exact code changes: Kernel Git Commit 0e7be42, Kernel Git Commit 38290b18, and Kernel Git Commit d1e38551.

Detection Methods for CVE-2026-64080

Indicators of Compromise

Unexpected kernel oops or general protection fault messages referencing arm_ffa notification functions in dmesg or /var/log/kern.log
KASAN (Kernel Address Sanitizer) reports flagging use-after-free events in arm_ffa notification callback paths
Unexplained kernel panics on Arm platforms during FF-A notifier registration or teardown

Detection Strategies

Compare running kernel versions against fixed stable branches referenced in the upstream commits to identify unpatched hosts
Enable KASAN in test builds to surface the use-after-free during fuzzing of FF-A notification interfaces
Audit kernel crash telemetry for stack traces containing arm_ffa notifier symbols and race-condition signatures

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on repeated arm_ffa faults or KASAN reports
Monitor loading of the arm_ffa module and unexpected process activity on Arm-based hosts
Track privilege escalation attempts and anomalous root-level process creation following kernel warnings

How to Mitigate CVE-2026-64080

Immediate Actions Required

Apply the upstream stable kernel updates that include the three referenced commits fixing the notifier callback snapshot logic
Inventory Arm-based Linux systems using FF-A and prioritize patching hosts exposed to untrusted local users
Restrict local shell access on affected systems until patches are deployed

Patch Information

The Linux kernel maintainers resolved the vulnerability by capturing the callback function pointer and callback data while notify_lock is still held, then invoking the callback after the lock is released. This preserves the existing callback execution model while eliminating the use-after-free window. The fix is distributed across commits 0e7be42, 38290b18, and d1e38551 in the stable kernel tree.

Workarounds

Where patching is not immediately feasible, blacklist or unload the arm_ffa module on systems that do not require FF-A notifications
Enforce strict local access controls and remove shell access for untrusted accounts on affected Arm hosts
Enable kernel hardening options such as SMEP, SMAP, and KASLR to raise the exploitation bar for use-after-free primitives

bash

# Verify kernel version and check for the arm_ffa module
uname -r
lsmod | grep arm_ffa

# Temporary mitigation: prevent arm_ffa from loading
echo "blacklist arm_ffa" | sudo tee /etc/modprobe.d/blacklist-arm-ffa.conf
sudo update-initramfs -u

# After patching, reboot into the fixed kernel
sudo reboot