Executive brief
A vulnerability was identified in the Linux kernel's ARM FF-A (Firmware Framework for Arm A-profile) subsystem. This component manages communication between the operating system and secure firmware. An issue in how drivers are registered could allow a malformed or 'buggy' driver to cause a system crash (kernel panic), potentially leading to a denial of service.
Technical details
A vulnerability exists in the ARM FF-A bus implementation within the Linux kernel (drivers/firmware/arm_ffa/bus.c). The bus match callback, `ffa_device_match`, unconditionally dereferences the `id_table` pointer provided by an FF-A driver. If a client driver is registered without an `id_table`, the kernel will encounter a NULL pointer dereference during the device matching process, resulting in a kernel oops/crash. The fix enforces the presence of both a probe function and an `id_table` during `ffa_driver_register` and adds a safety check in the match callback. This is primarily a local denial-of-service vector requiring the ability to load or trigger the registration of a faulty FF-A driver.
Affected products
- Linux Linux 5.14 to 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34
Timeline
- 2026-04-28: other: Patch authored
- 2026-07-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0a5e695095c557d2380131b613dea4e8d90371be
- https://git.kernel.org/stable/c/198f6c86d508ed562f07dc00276cac6dbb5dd3bf
- https://git.kernel.org/stable/c/34f59211984f66788390e7469f3e99d3796db4a8
- https://git.kernel.org/stable/c/820245d86ce58898fb48b4fefc77d0cafc02801d
- https://git.kernel.org/stable/c/adfff93d08a2e12ecf2a1eba272d18bc749f13c0
- https://git.kernel.org/stable/c/bc499d1acddbb75b5b4bce05f5296dd8ef9611fd
- https://git.kernel.org/stable/c/f98f131256beaddd51ad468e95d90d857fef12bf