CVE-2026-64166: Linux Kernel FF-A DOS Vulnerability

CVE-2026-64166 Overview

CVE-2026-64166 is a Linux kernel vulnerability in the arm_ffa firmware driver. The bus match callback dereferences the FF-A driver id_table unconditionally, assuming every driver provides one. A client driver that registers without an id_table triggers a NULL pointer dereference during bus matching. The fix enforces the id_table contract at driver registration time so a malformed client cannot crash the FF-A bus.

The issue affects the Arm Firmware Framework for Arm (FF-A) subsystem, which handles secure world communication on Arm platforms. The vulnerability is categorized as a NULL Pointer Dereference [CWE-476] leading to a kernel denial of service.

Critical Impact
A buggy or malicious in-tree FF-A client driver can crash the kernel by omitting an id_table, disrupting the FF-A bus and any dependent secure world services.

Affected Products

Linux kernel builds enabling the arm_ffa firmware driver on Arm platforms
Downstream distributions shipping the vulnerable drivers/firmware/arm_ffa/ code prior to the referenced stable patches
Systems running FF-A client drivers loaded via the kernel bus infrastructure

Discovery Timeline

2026-07-19 - CVE-2026-64166 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64166

Vulnerability Analysis

The Arm FF-A driver framework in drivers/firmware/arm_ffa/bus.c registers a bus type whose match callback compares a device's UUID against entries in the driver's id_table. The pre-patch match logic dereferences ffa_drv->id_table without first checking whether the pointer is NULL. Any FF-A driver that registers without populating id_table causes the kernel to fault when the bus attempts to match devices.

Because the match callback runs in kernel context on every device registration or driver probe, a single misconfigured client is sufficient to oops the kernel. The result is a NULL pointer dereference in kernel space, producing a panic or task kill depending on kernel configuration.

Root Cause

The root cause is a missing precondition check. The FF-A subsystem defined an implicit contract that drivers must supply an id_table, but never enforced it. Registration paths such as ffa_driver_register() accepted driver structures with id_table == NULL, deferring the failure until the bus match callback executed and dereferenced the pointer.

Attack Vector

The vulnerability requires a kernel driver — either buggy or intentionally crafted — to register with the FF-A bus without an id_table. Exploitation is not remote and does not target user-space input directly. The impact is availability: the kernel crashes when the FF-A bus attempts a device-driver match. Attackers with the ability to load kernel modules on affected systems could weaponize this for local denial of service.

The fix, applied across the stable trees in commits 0a5e695, 198f6c8, 34f5921, 820245d, adfff93, bc499d1, and f98f131, rejects driver registration when id_table is NULL, preventing the unsafe dereference from ever executing.

Detection Methods for CVE-2026-64166

Indicators of Compromise

Kernel oops or panic messages referencing ffa_bus_match or drivers/firmware/arm_ffa/bus.c in dmesg and /var/log/kern.log
Unexpected reboots on Arm platforms coinciding with FF-A driver load or hotplug events
Loaded kernel modules interacting with FF-A that lack a declared id_table structure

Detection Strategies

Audit installed kernel packages against the fixed commits listed in the kernel.org stable tree to confirm whether the patch is applied
Inspect loaded modules on Arm systems with lsmod and cross-reference sources for FF-A drivers missing id_table definitions
Monitor kernel crash telemetry for repeated faults in the FF-A match path, which indicates the pre-patch code is running

Monitoring Recommendations

Forward dmesg and kernel crash dumps to a central log platform to detect FF-A-related oops signatures
Track kernel version inventory across Arm fleet assets to prioritize patching of vulnerable builds
Alert on unexpected module load events on production Arm systems, particularly those touching firmware/arm_ffa

How to Mitigate CVE-2026-64166

Immediate Actions Required

Update affected Linux kernels to a stable release containing one of the referenced fix commits
Restrict kernel module loading to signed, vetted modules using kernel.modules_disabled or module signature enforcement
Inventory Arm-based hosts and virtual machines that enable FF-A support to scope exposure

Patch Information

Upstream fixes are available in the Linux stable tree. Apply the appropriate commit for your kernel branch:

Workarounds

Disable the arm_ffa driver in the kernel configuration on systems that do not require FF-A functionality
Prevent loading of unaudited third-party FF-A client drivers until the patch is deployed
Enforce module signature verification via CONFIG_MODULE_SIG_FORCE to block untrusted drivers that could trigger the NULL dereference

bash

# Verify running kernel version and check for the fix
uname -r
grep -R "id_table" /lib/modules/$(uname -r)/build/drivers/firmware/arm_ffa/ 2>/dev/null

# Enforce module signature verification at boot
echo "module.sig_enforce=1" >> /etc/default/grub
update-grub