Executive brief
The Linux kernel's ARM Firmware Framework for ARM (FFA) driver contains a NULL pointer dereference vulnerability in the ffa_partition_info_get() function. A caller passing a NULL pointer as a partition UUID argument causes the kernel to crash. This impacts system stability and availability on ARM-based platforms that use the FFA firmware interface.
Technical details
The vulnerability is a NULL pointer dereference in the ffa_partition_info_get() function within the ARM FFA firmware driver (drivers/firmware/arm_ffa/driver.c). The function passes the uuid_str parameter directly to uuid_parse() without checking for NULL, which then dereferences the NULL pointer in uuid_is_valid(), causing a kernel panic. The attack vector requires the ability to call ffa_partition_info_get() with a NULL argument; this would typically be from in-kernel code rather than userspace. The fix adds a NULL guard check (!uuid_str) before the uuid_parse() call, returning -ENODEV for NULL input. Patches are available in stable kernel trees.
Affected products
- Linux Linux kernel multiple versions via ARM FFA driver (d0c0bce83122 and later)
Timeline
- 2026-06-17: other: Vulnerability fixed upstream by Unnathi Chalicheemala
- 2026-08-03: patched: Patches merged to stable kernel trees
- 2026-08-12: disclosed: CVE-2026-68444 published