CVE-2026-64080
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In the Linux kernel, a use-after-free vulnerability was found in the ARM FFA firmware driver's notification handling. Notification handlers look up a callback pointer under a lock but invoke it after dropping the lock, allowing a concurrent unregister to delete and free the memory.
Risk Assessment
An attacker could exploit this vulnerability to execute arbitrary code in kernel context or cause a denial of service (DoS), compromising system confidentiality, integrity, and availability.
Recommendation
Immediately update the Linux kernel to a version containing the fix (commit referenced in CVE description). For production systems, apply the security patch after testing.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Snapshot notifier callbacks under lock Both notification handlers currently look up a notifier callback under notify_lock, drop the lock, and then dereference the returned notifier entry. A concurrent unregister can delete and free that entry in the gap, leaving the handler to dereference stale memory. Copy the callback pointer and callback data while notify_lock is still held and invoke the callback only after the lock is dropped. This keeps the existing callback execution model while removing the use-after-free window in both the framework and non-framework notification paths.