CVE-2026-68401: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-68401 Overview

CVE-2026-68401 is an out-of-bounds write vulnerability in the Linux kernel's Arm Firmware Framework for Armv8-A (FF-A) driver. The flaw resides in ffa_setup_and_transmit() inside drivers/firmware/arm_ffa/. A local reporter identified as Sashiko disclosed multiple out-of-bounds write conditions triggered when the driver populates endpoint memory access descriptors and constituent structures. The issue affects FF-A versions earlier than 1.2, where ffa_emad_size_get() returns 16 bytes while the driver writes to the reserved field at offset 24. Kernel maintainers resolved the vulnerability with commits 27abdaf0c5c8, 3383ffb7ef93, and cf5708c9d78c.

Critical Impact
A local attacker with the ability to invoke the arm_ffa driver can corrupt adjacent kernel memory, leading to privilege escalation, kernel integrity loss, or system compromise.

Affected Products

Linux kernel builds including the arm_ffa firmware driver prior to the fixing commits
Systems using Arm FF-A versions earlier than 1.2
Arm-based platforms invoking ffa_setup_and_transmit() for memory sharing operations

Discovery Timeline

2026-08-10 - CVE-2026-68401 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68401

Vulnerability Analysis

The vulnerability is an out-of-bounds write [CWE-787] in the Linux kernel's arm_ffa firmware driver. The function ffa_setup_and_transmit() prepares memory transaction descriptors for the Arm Firmware Framework. When the negotiated FF-A version is below 1.2, the endpoint memory access descriptor structure is only 16 bytes long, as reported by ffa_emad_size_get(). The driver nevertheless writes to ep_mem_access->reserved, which sits at offset 24, producing a write past the allocated bounds.

A second out-of-bounds write occurs during the emission of memory region constituents. The driver did not verify that sufficient buffer space remained before writing constituent entries, allowing writes beyond the transaction buffer. Both conditions corrupt adjacent kernel memory used by neighboring driver structures.

Exploitation requires local access and low privileges. Successful abuse yields high impact to confidentiality, integrity, and availability by allowing an attacker to overwrite kernel memory adjacent to the transaction buffer.

Root Cause

The driver assumed a fixed layout for the endpoint memory access descriptor rather than deriving its size from the active FF-A version. Fields such as reserved were zeroed individually based on the compile-time structure definition, ignoring runtime version differences. The constituent emission path also lacked a bounds check against the remaining buffer size before writing entries.

Attack Vector

A local, low-privileged user or process that can reach the arm_ffa driver interface, for example through IOCTL paths or in-kernel callers that forward attacker-controlled parameters, can trigger the out-of-bounds writes. No user interaction is required. On Arm platforms where FF-A version negotiation resolves below 1.2, the descriptor write occurs unconditionally during transaction setup. See the fixing commits for the corrected zeroing and bounds-check logic: Kernel Git Commit 27abdaf, Kernel Git Commit 3383ffb, and Kernel Git Commit cf5708c.

Detection Methods for CVE-2026-68401

Indicators of Compromise

Kernel panics, Oops, or KASAN slab-out-of-bounds reports referencing ffa_setup_and_transmit in the call trace
Unexpected corruption of kernel structures allocated near FF-A transaction buffers on Arm hosts
Local processes invoking FF-A memory sharing paths on kernels negotiating FF-A version below 1.2

Detection Strategies

Enable CONFIG_KASAN on test kernels to catch out-of-bounds writes originating in arm_ffa code paths
Compare running kernel commit hashes against 27abdaf0c5c8, 3383ffb7ef93, and cf5708c9d78c to identify unpatched hosts
Audit local processes and containers permitted to reach firmware driver interfaces on Arm platforms

Monitoring Recommendations

Forward dmesg and kernel audit logs to a central SIEM and alert on stack traces containing ffa_setup_and_transmit or ffa_emad_size_get
Track privilege changes and new kernel modules loaded shortly after FF-A driver activity
Monitor Arm fleet inventory for kernels still reporting FF-A negotiation below version 1.2

How to Mitigate CVE-2026-68401

Immediate Actions Required

Apply the upstream kernel patches or update to a stable release incorporating commits 27abdaf0c5c8, 3383ffb7ef93, and cf5708c9d78c
Restrict local access on Arm systems to trusted users until patched kernels are deployed
Inventory Arm-based servers, edge devices, and workstations that expose FF-A functionality

Patch Information

The fix rewrites the descriptor initialization path to memset the endpoint memory access structure to zero based on the negotiated FF-A version, replacing per-field zeroing that assumed a fixed layout. The patch also adds a size check before writing constituents and converts a sizeof() on a type to sizeof() on the variable for correctness. Backports are available in the stable trees referenced in the three kernel.org commits.

Workarounds

Disable or unload the arm_ffa driver on systems that do not require FF-A memory sharing
Constrain access to firmware driver interfaces using seccomp, SELinux, or AppArmor policies
Where possible, force negotiation to FF-A version 1.2 or later to avoid the affected code path

bash

# Verify kernel includes the fixing commit and remove the driver if not required
uname -r
modprobe -r arm_ffa 2>/dev/null || echo "arm_ffa not loaded or built-in"
# Confirm the driver is absent from the running kernel
lsmod | grep arm_ffa