Executive brief
A vulnerability in the Linux kernel's virtualization component (KVM) for ARM64 systems could allow a privileged user in the host operating system to cause a system crash or potentially access restricted memory. The issue occurs when the system handles memory sharing requests between different secure environments. This could lead to a complete loss of system stability or unauthorized access to sensitive data managed by the hypervisor.
Technical details
An out-of-bounds (OOB) access vulnerability exists in the Linux kernel's KVM arm64 hypervisor (nVHE) within the Arm Firmware Framework for Armv8-A (FF-A) implementation. The function `__do_ffa_mem_xfer` in `arch/arm64/kvm/hyp/nvhe/ffa.c` failed to check for integer overflows when calculating the offset for memory region descriptors. A malicious or compromised host kernel could provide a large offset value that, when added to the size of `ffa_composite_mem_region`, wraps around and bypasses length checks. This allows an attacker with high privileges to trigger OOB memory access in the hypervisor context. Patches have been released for various stable kernel branches including 6.6.y, 6.12.y, and 6.17.y.
Affected products
- Linux Linux Kernel 3.11 to 6.18
Timeline
- 2025-10-17: other: Patch submitted by developer
- 2025-12-01: patched: Patches committed to stable trees
- 2025-12-04: disclosed: CVE published