Junglewise Threat Intelligence

CVE-2026-64166: Linux Kernel NULL pointer dereference in ARM FF-A driver registration

CVE-2026-64166 · Severity: info · CVSS 0 · Published 2026-07-19

Technologies: Linux. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's ARM FF-A (Firmware Framework for Arm A-profile) subsystem. This component manages communication between the operating system and secure firmware. An issue in how drivers are registered could allow a malformed or 'buggy' driver to cause a system crash (kernel panic), potentially leading to a denial of service.

Technical details

A vulnerability exists in the ARM FF-A bus implementation within the Linux kernel (drivers/firmware/arm_ffa/bus.c). The bus match callback, `ffa_device_match`, unconditionally dereferences the `id_table` pointer provided by an FF-A driver. If a client driver is registered without an `id_table`, the kernel will encounter a NULL pointer dereference during the device matching process, resulting in a kernel oops/crash. The fix enforces the presence of both a probe function and an `id_table` during `ffa_driver_register` and adds a safety check in the match callback. This is primarily a local denial-of-service vector requiring the ability to load or trigger the registration of a faulty FF-A driver.

Affected products

  • Linux Linux 5.14 to 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34

Timeline

  • 2026-04-28: other: Patch authored
  • 2026-07-19: disclosed: CVE published

References