CVE-2026-68444: Linux Kernel Use-After-Free Vulnerability

CVE-2026-68444 Overview

CVE-2026-68444 is a NULL pointer dereference vulnerability in the Linux kernel's Arm Firmware Framework for Armv8-A (FF-A) driver. The flaw resides in the ffa_partition_info_get() function within the arm_ffa firmware module. The function passes a uuid_str argument directly to uuid_parse() without validating that the pointer is non-NULL. When a kernel caller supplies a NULL value, the call chain uuid_parse() → __uuid_parse() → uuid_is_valid() dereferences the NULL pointer and triggers a kernel panic.

Critical Impact
A NULL argument passed to ffa_partition_info_get() produces an unhandled kernel NULL pointer dereference at virtual address 0x40, resulting in a kernel panic and denial of service on affected Arm platforms.

Affected Products

Linux kernel arm_ffa firmware driver (Arm FF-A subsystem)
Multiple upstream stable kernel branches receiving backported fixes
Arm-based systems that load the arm_ffa module and expose partition discovery APIs to in-kernel callers

Discovery Timeline

2026-08-12 - CVE-2026-68444 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-68444

Vulnerability Analysis

The defect is a classic missing input validation flaw in a kernel firmware interface. The ffa_partition_info_get() helper in the arm_ffa driver accepts a UUID string and forwards it to the kernel UUID parser without checking whether the pointer is valid. The parser assumes a legal string address and immediately reads from it, so a NULL argument reaches uuid_is_valid() and dereferences address 0x40 in the string traversal path.

The kernel oops output confirms the crash location:

Unable to handle kernel NULL pointer dereference at virtual address
0000000000000040
pc : uuid_parse+0x40/0xac
lr : ffa_partition_info_get+0x1c/0x94 [arm_ffa]

The upstream fix adds a NULL guard before invoking uuid_parse(). When the argument is NULL, the function now returns -ENODEV rather than crashing. The maintainers note that callers are expected to always supply a valid partition UUID and that NULL is not a supported input, so the guard is defensive rather than a functional change.

Root Cause

The root cause is a missing NULL pointer check on function input [CWE-476]. ffa_partition_info_get() trusts its uuid_str parameter and passes it straight into uuid_parse(), which does not tolerate NULL. Any in-kernel caller that reaches this path with an uninitialized or optional UUID pointer panics the system.

Attack Vector

Exploitation requires an in-kernel caller of ffa_partition_info_get() that supplies a NULL UUID pointer. This is not a remote or unprivileged user-space attack path. The realistic exposure is stability: a buggy or attacker-influenced kernel component, driver, or firmware interaction that reaches this API with NULL causes a denial of service via kernel panic. See the kernel patch commit 12a42c6 and kernel patch commit 996c5c1 for the fix implementation.

// Vulnerable pattern (conceptual, based on advisory text):
// ffa_partition_info_get(uuid_str, ...) -> uuid_parse(uuid_str, ...)
// -> __uuid_parse() -> uuid_is_valid() dereferences NULL
//
// Fixed pattern:
// if (!uuid_str)
//     return -ENODEV;
// uuid_parse(uuid_str, ...);

Detection Methods for CVE-2026-68444

Indicators of Compromise

Kernel oops messages containing Unable to handle kernel NULL pointer dereference at virtual address 0000000000000040
Stack traces showing pc : uuid_parse+0x40/0xac with lr : ffa_partition_info_get+0x1c/0x94 [arm_ffa]
Unexpected reboots or panics on Arm systems with the arm_ffa module loaded

Detection Strategies

Inventory Arm-based Linux hosts and confirm whether the arm_ffa module is loaded using lsmod | grep arm_ffa.
Compare running kernel versions against the fixed commits referenced in the upstream stable tree to identify unpatched systems.
Parse dmesg, journalctl -k, and /var/log/kern.log for the specific panic signature associated with uuid_parse and ffa_partition_info_get.

Monitoring Recommendations

Forward kernel logs from Arm hosts to a centralized logging pipeline and alert on repeated kernel oops or panic events referencing the arm_ffa module.
Track host uptime and unexpected reboots across Arm fleets to surface stability regressions consistent with this defect.
Monitor package management events for kernel updates to verify that patched builds are deployed across affected systems.

How to Mitigate CVE-2026-68444

Immediate Actions Required

Update to a Linux kernel build that includes the upstream fix from the referenced stable commits.
Prioritize Arm-based servers, edge devices, and virtualization hosts that rely on FF-A partition discovery.
Validate that any out-of-tree drivers or vendor modules calling ffa_partition_info_get() supply a non-NULL UUID pointer.

Patch Information

The issue is resolved across multiple stable kernel branches. Reference commits: kernel patch commit 12a42c6, kernel patch commit 7201e56, kernel patch commit 86f5ea9, kernel patch commit 8ae5f8e, and kernel patch commit 996c5c1. Apply the vendor kernel package that incorporates these fixes.

Workarounds

If patching is not immediately possible, restrict loading of the arm_ffa module on hosts that do not require FF-A partition services.
Audit in-tree and out-of-tree callers of ffa_partition_info_get() and enforce a non-NULL UUID contract in caller code.
Isolate Arm systems that cannot be patched from workloads that dynamically load third-party kernel modules interacting with FF-A.

bash

# Confirm whether the affected module is loaded
lsmod | grep arm_ffa

# Check running kernel version against patched builds
uname -r

# Search kernel logs for the panic signature
dmesg | grep -E 'ffa_partition_info_get|uuid_parse'