CVE-2026-64080 firmware: arm_ffa: Snapshot notifier callbacks under lock
A race condition in the Linux kernel's ARM FFA driver allows a use-after-free, potentially enabling local attackers to execute code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64080?
CVE-2026-64080 is a critical use after free vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_ffa: Snapshot notifier callbacks under lock
Both notification handlers currently look up a notifier callback under notify_lock, drop the lock, and then dereference the returned notifier entry. A concurrent unregister can delete and free that entry in the gap, leaving the handler to dereference stale memory.
Copy the callback pointer and callback data while notify_lock is still held and invoke the callback only after the lock is dropped. This keeps the existing callback execution model while removing the use-after-free window in both the framework and non-framework notification paths.
Weakness: CWE-416
Which versions are affected by CVE-2026-64080?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64080?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-64080 being exploited?
There is no known exploitation of CVE-2026-64080 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-64080, DEBIAN-CVE-2026-64080, GHSA-jcvp-p3m6-xg77, UBUNTU-CVE-2026-64080.