CVE-2026-68400
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In the Linux kernel's arm_ffa driver, there is an error in calculating the Endpoint Memory Access descriptor offset, which uses sizeof(struct ffa_mem_region) instead of ep_mem_offset, potentially leading to incorrect memory access. There is also a lack of sanity checks for offsets.
Risk Assessment
This could lead to incorrect driver behavior, system crashes, or potential exploitation for memory integrity violation.
Recommendation
Apply the Linux kernel update containing the fix that uses ep_mem_offset and adds sanity checks.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation Use the descriptor's `ep_mem_offset` to calculate the start of the endpoint memory access array and to comply with the FF-A spec instead of defaulting to `sizeof(struct ffa_mem_region)`. This requires moving `ffa_mem_region_additional_setup()` earlier in the setup flow. Also, add sanity checks to ensure the calculated descriptor offsets do not exceed `max_fragsize`.