CVE-2026-64081 Overview
CVE-2026-64081 is a Linux kernel vulnerability in the ARM Firmware Framework for Armv8-A (arm_ffa) driver. The flaw allows out-of-bounds reads and oversized memory allocations when processing framework notification messages delivered through the shared RX buffer. Malformed firmware data can drive the kernel to read beyond intended message boundaries because the reported offset and size values are not validated before use in kmemdup() and UUID parsing paths.
The issue impacts the confidentiality, integrity, and availability of affected Linux systems. Exploitation requires local access to a system running a vulnerable kernel that communicates with a compromised or malicious secure-world firmware endpoint.
Critical Impact
Malformed firmware notification messages can trigger out-of-bounds memory reads or oversized kernel allocations, exposing sensitive kernel memory or destabilizing the system.
Affected Products
- Linux kernel builds that include the firmware/arm_ffa driver
- Systems using the ARM Firmware Framework for Armv8-A (FF-A) interface
- ARM-based platforms relying on FF-A framework notifications for secure-world communication
Discovery Timeline
- 2026-07-19 - CVE-2026-64081 published to the National Vulnerability Database
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-64081
Vulnerability Analysis
The vulnerability resides in the ARM FF-A driver's handling of framework notifications. FF-A framework notifications carry an indirect message inside the shared RX buffer between the normal world (Linux) and the secure world (firmware). The driver reads an offset and size from that message to locate the payload, then uses those attacker-controlled values in kmemdup() and UUID parsing routines without validation.
Because the offset and size are trusted, a malicious or malformed firmware response can point outside the message bounds, request zero-length payloads, or place a non-header payload in the middle of the message header. The result is an out-of-bounds read across kernel memory adjacent to the RX buffer, or a request for an oversized kernel allocation that destabilizes the system.
Root Cause
The root cause is missing input validation on values supplied by firmware. The driver does not verify that the payload offset lands at the UUID field, that the payload size fits within the shared buffer, or that the size is non-zero. Without these checks, malformed message layouts propagate directly into memory duplication and parsing logic, producing an Out-of-Bounds Read [CWE-125] condition.
Attack Vector
An attacker requires local presence on the affected system and the ability to influence firmware notification content, for example through a compromised secure-world component or a malicious FF-A partition. The attacker crafts a framework notification with a manipulated offset and size in the RX buffer. When the kernel processes the notification, it reads memory outside the intended payload region or attempts a large allocation.
Detailed exploitation code is not available. Refer to the upstream commits 3c51d99449dc, 4a1cc9e96b31, and 76eb90e2b03d for the corrective changes that reveal the affected code paths. See the Linux kernel stable commit 76eb90e2b03d for the fix details.
Detection Methods for CVE-2026-64081
Indicators of Compromise
- Kernel log messages referencing arm_ffa framework notification errors, malformed message layouts, or unexpected UUID parsing failures
- Unexpected large kernel allocations originating from the ffa_notification_info_get or related notification handler paths
- KASAN reports flagging out-of-bounds reads in the arm_ffa driver on affected systems
Detection Strategies
- Enable Kernel Address Sanitizer (KASAN) on test kernels to surface out-of-bounds reads within the FF-A notification handling path
- Audit installed kernel versions against the fixed stable trees and identify hosts running unpatched arm_ffa code
- Correlate dmesg output with firmware update events to detect anomalous FF-A message activity following firmware changes
Monitoring Recommendations
- Forward kernel logs from ARM-based servers and edge devices to a central log platform for anomaly review
- Alert on repeated arm_ffa warning or error messages that may indicate probing of the notification path
- Track kernel version inventory across ARM fleets and flag hosts that have not received the fix commits
How to Mitigate CVE-2026-64081
Immediate Actions Required
- Apply the upstream Linux kernel stable updates that include commits 3c51d99449dc, 4a1cc9e96b31, and 76eb90e2b03d
- Prioritize patching on ARM platforms that expose the FF-A interface to untrusted or updatable firmware components
- Restrict local access on affected systems until the patched kernel is deployed
Patch Information
The fix validates the reported offset and size in framework notification messages before use, rejects zero-length payloads, and ensures non-header payloads start at the UUID field. The validated values are then used for both kmemdup() and UUID parsing. Patches are available in the Linux stable tree via the 3c51d99449dc commit, the 4a1cc9e96b31 commit, and the 76eb90e2b03d commit.
Workarounds
- Where feasible, disable or unload the arm_ffa driver on systems that do not require FF-A functionality
- Enforce firmware image signing and secure boot to limit the ability of an attacker to supply malformed FF-A messages
- Limit local shell access to trusted administrators until patched kernels are in place
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
