CVE-2026-64520: Linux Kernel Privilege Escalation Flaw

CVE-2026-64520 Overview

CVE-2026-64520 is an out-of-bounds write vulnerability in the Linux kernel's Arm Firmware Framework for Arm A-profile (arm_ffa) driver. The register-based PARTITION_INFO_GET_REGS code path trusted firmware-provided indices when copying partition descriptors into the caller buffer. A malicious or compromised firmware component can return inconsistent counts or index progressions, causing the copy loop to write past the allocated descriptor array. The upstream fix rejects inconsistent counts and index progressions before the copy occurs, and corrects cur_idx handling when exactly one descriptor is returned in the first fragment.

Critical Impact
A local attacker able to influence Secure Partition Manager responses can trigger kernel memory corruption, leading to privilege escalation, denial of service, or loss of kernel integrity.

Affected Products

Linux kernel branches containing the arm_ffa register-based PARTITION_INFO_GET path
Systems using Arm FF-A (Firmware Framework for Arm A-profile) partition discovery
Distributions shipping the vulnerable drivers/firmware/arm_ffa code prior to the referenced stable commits

Discovery Timeline

2026-07-25 - CVE-2026-64520 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64520

Vulnerability Analysis

The Arm FF-A driver exposes PARTITION_INFO_GET, which the kernel uses to enumerate secure partitions reported by the Secure Partition Manager. The register-based variant (PARTITION_INFO_GET_REGS) returns descriptor data through CPU registers across one or more fragments. Each fragment carries a partition count and an index progression that the kernel uses to place descriptors into an allocated caller buffer.

The pre-patch implementation trusted these firmware-provided values without validating that the reported indices remained monotonic and within the allocated buffer bounds. A firmware response that reported an index beyond the buffer capacity, or that skipped indices inconsistently across fragments, caused the copy loop to write partition descriptor structures past the end of the destination array. This is an out-of-bounds write in kernel memory [CWE-787].

Root Cause

The root cause is missing input validation on trust-boundary data. The FF-A specification places the Secure Partition Manager in a separate security domain, so its outputs must be treated as untrusted by the kernel. The affected code path treated the returned count and cursor index as authoritative, and used them directly as array offsets. There was also an off-by-one edge case in cur_idx handling when the first fragment contained exactly one descriptor.

Attack Vector

Exploitation requires local access with the ability to influence FF-A firmware responses, either through a compromised secure world component, a malicious Trusted Execution Environment application, or a hypervisor scenario where the caller controls partition metadata. An attacker who returns crafted descriptor indices during partition enumeration corrupts kernel heap memory adjacent to the descriptor buffer, enabling privilege escalation or a controllable kernel panic.

No public proof-of-concept is available. See the upstream commits 3974ea1, 79d95c0, and f39bc7e for the exact validation logic added by the fix.

Detection Methods for CVE-2026-64520

Indicators of Compromise

Unexpected kernel oops or panic messages referencing ffa_setup_partitions, ffa_partition_probe, or the arm_ffa module during boot or driver load
KASAN (Kernel Address Sanitizer) reports of slab-out-of-bounds writes originating in drivers/firmware/arm_ffa/driver.c
Anomalous FF-A partition counts logged by the kernel that do not match the platform's declared secure partition inventory

Detection Strategies

Enable KASAN on test kernels running Arm FF-A workloads to surface out-of-bounds writes deterministically
Compare the running kernel version and arm_ffa source against the three referenced upstream commit hashes
Audit distribution advisories for backports referencing PARTITION_INFO_GET_REGS bounds validation

Monitoring Recommendations

Collect kernel ring buffer output (dmesg) at boot and after driver reloads, forwarding to a centralized log store for kernel-crash correlation
Alert on repeated FF-A driver initialization failures across a fleet of Arm servers or edge devices
Track Linux kernel package versions against vendor security bulletins to identify hosts still exposed to the flaw

How to Mitigate CVE-2026-64520

Immediate Actions Required

Inventory Arm A-profile systems that load the arm_ffa driver and identify those running kernels prior to the fix
Apply the vendor-supplied kernel update that incorporates commits 3974ea1, 79d95c0, and f39bc7e
Restrict local access on affected hosts, particularly on systems where untrusted secure-world components may be loaded

Patch Information

The fix is applied across the following upstream commits: 3974ea1938406f9bfa7c1f48d4e43533f447bb08, 79d95c02ae0a95e6e80e8e92b7ca74ecee02854f, and f39bc7ebe75e2186b417a024a7f7e2fd4cc7eb95. The patch validates that partition counts and index progressions are consistent before copying descriptors, and corrects cur_idx when exactly one descriptor is returned in the first fragment. Rebuild kernel packages or pull stable-tree updates that include these commits.

Workarounds

Blacklist the arm_ffa module on systems that do not require FF-A partition discovery, using modprobe.d configuration to prevent driver load
Where FF-A is unused, disable CONFIG_ARM_FFA_TRANSPORT in custom kernel builds and rebuild the kernel
Limit the ability to load untrusted secure partitions or TEE applications until the patched kernel is deployed

bash

# Example: prevent the vulnerable driver from loading on hosts that do not need FF-A
echo "blacklist arm_ffa" | sudo tee /etc/modprobe.d/blacklist-arm-ffa.conf
sudo update-initramfs -u
# Verify after reboot
lsmod | grep arm_ffa || echo "arm_ffa not loaded"