CVE-2026-64081 firmware: arm_ffa: Validate framework notification message layout
A missing validation in the Linux kernel's ARM FFA driver allows out-of-bounds reads or oversized allocations via malformed firmware notifications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64081?
CVE-2026-64081 is a high-severity memory corruption vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_ffa: Validate framework notification message layout
Framework notifications carry an indirect message in the shared RX buffer. Validate the reported offset and size before using them, reject zero-length payloads, and ensure that any non-header payload starts at the UUID field rather than in the middle of the message header.
Use the validated offset and size values for both kmemdup() and the UUID parsing path so malformed firmware data cannot drive an out-of-bounds read or an oversized allocation.
Weakness: CWE-787
Which versions are affected by CVE-2026-64081?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64081?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-64081 being exploited?
There is no known exploitation of CVE-2026-64081 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-64081, DEBIAN-CVE-2026-64081, GHSA-jv9h-h3cq-mm9x, UBUNTU-CVE-2026-64081.