CVE-2026-64081

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64081", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.031Z", "datePublished": "2026-07-19T15:39:53.433Z", "dateUpdated": "2026-08-05T12:39:00.788Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:39:00.788Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_ffa: Validate framework notification message layout\n\nFramework notifications carry an indirect message in the shared RX\nbuffer. Validate the reported offset and size before using them, reject\nzero-length payloads, and ensure that any non-header payload starts at\nthe UUID field rather than in the middle of the message header.\n\nUse the validated offset and size values for both kmemdup() and the UUID\nparsing path so malformed firmware data cannot drive an out-of-bounds\nread or an oversized allocation."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached when the ARM FF-A partition manager delivers a framework RX-buffer-full notification to the Linux host via per-CPU IRQ and SMCCC, not via network packets or physical device access.\nAC:L - A malicious or compromised FF-A sender partition can craft the indirect message header offset and size fields directly in its TX buffer and reliably trigger the vulnerable kmemdup path on delivery.\nPR:N - No Linux credentials, capabilities, or user-namespace privileges are checked or required on the vulnerable IRQ-driven path; exploitation only requires the ability to send a crafted FF-A indirect message from a peer partition or firmware.\nUI:N - Processing is automatic once the framework delivers the notification and fills the shared RX buffer; no victim user action is needed.\nS:U - The impact is kernel memory disclosure and denial of service within the host kernel security authority, not a VM escape or cross-IOMMU boundary bypass.\nC:H - Unvalidated offset and size allow kmemdup to copy attacker-chosen amounts of kernel memory beyond the bounded RX buffer, constituting an out-of-bounds read of kernel memory.\nI:H - The attacker-controlled out-of-bounds copy primitive reads adjacent kernel objects and is a standard building block for kernel exploit chains that achieve arbitrary write and code execution.\nA:H - Crafted values can cause kernel faults on invalid addresses during the out-of-bounds copy, or massive kmemdup allocations that exhaust kernel memory and crash or deny service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/firmware/arm_ffa/driver.c"], "versions": [{"version": "285a5ea0f542db94c3ed11e01a71abb47d15cbf5", "lessThan": "3c51d99449dc5a01c08a7fce6071d6721f5aac83", "status": "affected", "versionType": "git"}, {"version": "285a5ea0f542db94c3ed11e01a71abb47d15cbf5", "lessThan": "76eb90e2b03de147e12ab68ea8afd8ea0342df0a", "status": "affected", "versionType": "git"}, {"version": "285a5ea0f542db94c3ed11e01a71abb47d15cbf5", "lessThan": "4a1cc9e96b311d2609a6f963a5e35bd4ae730d97", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/firmware/arm_ffa/driver.c"], "versions": [{"version": "6.15", "status": "affected"}, {"version": "0", "lessThan": "6.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.34", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.11", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.18.34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.0.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3c51d99449dc5a01c08a7fce6071d6721f5aac83"}, {"url": "https://git.kernel.org/stable/c/76eb90e2b03de147e12ab68ea8afd8ea0342df0a"}, {"url": "https://git.kernel.org/stable/c/4a1cc9e96b311d2609a6f963a5e35bd4ae730d97"}], "title": "firmware: arm_ffa: Validate framework notification message layout", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/firmware/arm_ffa/driver.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3c51d99449dc5a01c08a7fce6071d6721f5aac83", "status": "affected", "version": "285a5ea0f542db94c3ed11e01a71abb47d15cbf5", "versionType": "git"}, {"lessThan": "76eb90e2b03de147e12ab68ea8afd8ea0342df0a", "status": "affected", "version": "285a5ea0f542db94c3ed11e01a71abb47d15cbf5", "versionType": "git"}, {"lessThan": "4a1cc9e96b311d2609a6f963a5e35bd4ae730d97", "status": "affected", "version": "285a5ea0f542db94c3ed11e01a71abb47d15cbf5", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/firmware/arm_ffa/driver.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"lessThan": "6.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.34", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "89E9B97C-FD82-4D2E-8426-3A1A703B2ED7", "versionEndExcluding": "6.18.34", "versionStartIncluding": "6.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0520D091-FC52-4A50-AF07-70AE7D08B750", "versionEndExcluding": "7.0.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_ffa: Validate framework notification message layout\n\nFramework notifications carry an indirect message in the shared RX\nbuffer. Validate the reported offset and size before using them, reject\nzero-length payloads, and ensure that any non-header payload starts at\nthe UUID field rather than in the middle of the message header.\n\nUse the validated offset and size values for both kmemdup() and the UUID\nparsing path so malformed firmware data cannot drive an out-of-bounds\nread or an oversized allocation."}], "id": "CVE-2026-64081", "lastModified": "2026-09-03T13:06:31.643", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-07-19T16:17:48.707", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3c51d99449dc5a01c08a7fce6071d6721f5aac83"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4a1cc9e96b311d2609a6f963a5e35bd4ae730d97"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/76eb90e2b03de147e12ab68ea8afd8ea0342df0a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: firmware: arm_ffa: Validate framework notification message layout", "id": "2502488", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502488"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nfirmware: arm_ffa: Validate framework notification message layout\nFramework notifications carry an indirect message in the shared RX\nbuffer. Validate the reported offset and size before using them, reject\nzero-length payloads, and ensure that any non-header payload starts at\nthe UUID field rather than in the middle of the message header.\nUse the validated offset and size values for both kmemdup() and the UUID\nparsing path so malformed firmware data cannot drive an out-of-bounds\nread or an oversized allocation.", "A flaw was found in the Linux kernel's ARM Firmware Framework for Arm (arm_ffa) component. This vulnerability arises from insufficient validation of framework notification message layouts. A local attacker, by providing specially crafted firmware data in the shared RX buffer, could trigger an out-of-bounds read or an oversized memory allocation. This could lead to memory corruption, potentially impacting system stability or allowing for further exploitation."], "name": "CVE-2026-64081", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64081\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64081\nhttps://lore.kernel.org/linux-cve-announce/2026071915-CVE-2026-64081-cb26@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[285a5ea0f542db94c3ed11e01a71abb47d15cbf5,3c51d99449dc5a01c08a7fce6071d6721f5aac83)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[285a5ea0f542db94c3ed11e01a71abb47d15cbf5,76eb90e2b03de147e12ab68ea8afd8ea0342df0a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[285a5ea0f542db94c3ed11e01a71abb47d15cbf5,4a1cc9e96b311d2609a6f963a5e35bd4ae730d97)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.34,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.11,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T10:00:04.564434+00:00", "updated": "2026-09-03T15:45:05.343283+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}