CVE-2026-68401

A flaw was found in the ARM Firmware Framework for Arm (FFA) driver within the Linux kernel. This vulnerability, specifically in the ffa_setup_and_transmit() function, allows for out-of-bounds writes due to incorrect size handling when writing to memory descriptors and constituents. An attacker could potentially exploit this to corrupt memory, which may lead to system instability or a denial of service.

This vulnerability is rated Moderate because exploitation requires local access and complex prerequisites on systems utilizing Arm Firmware Framework interfaces, limiting the attack surface and potential blast radius. The issue stems from boundary check deficiencies during firmware descriptor setup, which could allow a local authenticated attacker to trigger memory corruption leading to system instability or denial of service. Standard Red Hat Enterprise Linux releases do not include the affected code, confining exposure to specialized ARM platforms such as Red Hat Enterprise Linux for NVIDIA.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.