CVE-2026-64520 firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies
A missing bounds check in the Linux kernel's ARM FFA driver allows out-of-bounds writes, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64520?
CVE-2026-64520 is a high-severity memory corruption vulnerability in Linux, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies
The register-based PARTITION_INFO_GET path trusted the firmware-provided indices when copying partition descriptors into the caller buffer. Reject inconsistent counts or index progressions so the copy loop cannot write past the allocated array.
(fixed cur_idx when exactly one descriptor in the first fragment)
Which versions are affected by CVE-2026-64520?
How do I fix CVE-2026-64520?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-64520 being exploited?
There is no known exploitation of CVE-2026-64520 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-64520, DEBIAN-CVE-2026-64520, GHSA-p6rc-3j29-m628, ROOT-OS-DEBIAN-13-CVE-2026-64520, ROOT-OS-UBUNTU-2204-CVE-2026-64520, UBUNTU-CVE-2026-64520.