CVE-2025-40266 KVM: arm64: Check the untrusted offset in FF-A memory share
A missing bounds check in the Linux kernel KVM arm64 FF-A memory share allows out-of-bounds access, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40266?
CVE-2025-40266 is a high-severity memory corruption vulnerability in Linux, published on 4 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Check the untrusted offset in FF-A memory share
Verify the offset to prevent OOB access in the hypervisor FF-A buffer in case an untrusted large enough value [U32_MAX - sizeof(struct ffa_composite_mem_region) + 1, U32_MAX] is set from the host kernel.
Which versions are affected by CVE-2025-40266?
How do I fix CVE-2025-40266?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-40266 being exploited?
There is no known exploitation of CVE-2025-40266 in the wild and no public exploit code.
Sources
Also known as A-439862698, ASB-A-439862698, AZL-71422, BELL-CVE-2025-40266, DEBIAN-CVE-2025-40266, GHSA-3fjr-pmvp-g6q5 and 6 more.