CVE-2026-64081

A flaw was found in the Linux kernel's ARM Firmware Framework for Arm (arm_ffa) component. This vulnerability arises from insufficient validation of framework notification message layouts. A local attacker, by providing specially crafted firmware data in the shared RX buffer, could trigger an out-of-bounds read or an oversized memory allocation. This could lead to memory corruption, potentially impacting system stability or allowing for further exploitation.

The ARM FF-A framework notification handler used firmware supplied offset and size fields from the shared RX buffer before validating the message layout. Malformed firmware data could make kmemdup() copy from outside the valid notification payload or request an oversized allocation, which creates an OOB read and denial of service risk. For the CVSS the PR:H is used because reliable triggering normally requires control over firmware or an FF-A component that can generate framework notifications, not only ordinary local user access. The issue is not network reachable and is specific to affected ARM FF-A platforms. Impact is mainly denial of service with limited confidentiality risk from OOB read. Integrity impact is not supported because the primitive is read and allocation abuse, not an OOB write or arbitrary write.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.