Executive brief
A vulnerability was identified in the Linux kernel's ARM Firmware Framework (FF-A) driver. This component manages communication between the operating system and secure system firmware. An issue in how the driver handles partition information could allow a malicious or malfunctioning firmware component to cause memory corruption, potentially leading to a system crash or unauthorized access.
Technical details
A vulnerability in the Linux kernel's ARM FF-A (Firmware Framework for Arm A-profile) driver stems from the `__ffa_partition_info_get_regs` function trusting firmware-provided indices. Specifically, the register-based PARTITION_INFO_GET path did not validate the consistency of partition counts or index progressions when copying descriptors into the caller's buffer. This lack of bounds checking allows a copy loop to write past the allocated array, leading to a heap-based buffer overflow. An attacker with control over the firmware interface could exploit this to corrupt kernel memory. The issue has been resolved by implementing strict checks on index ranges and descriptor counts.
Affected products
- Linux Linux 6.12, 6.18.34, 7.0.11, 7.1
Timeline
- 2026-07-25: disclosed
- 2026-07-25: advisory