Riskcovery

CVE-2026-64520

firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies

State
Published
Severity
8.4 High
Published
Jul 25, 2026
Updated
Aug 5, 2026
Reserved
Jul 19, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies

The register-based PARTITION_INFO_GET path trusted the firmware-provided indices when copying partition descriptors into the caller buffer. Reject inconsistent counts or index progressions so the copy loop cannot write past the allocated array.

(fixed cur_idx when exactly one descriptor in the first fragment)

Scores

CVSSScoreVectorSource
3.18.4 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • ba85c644ac8dc37d9b01a3332c2f142cb4d46954 to before f39bc7ebe75e2186b417a024a7f7e2fd4cc7eb95Affected
  • ba85c644ac8dc37d9b01a3332c2f142cb4d46954 to before 79d95c02ae0a95e6e80e8e92b7ca74ecee02854fAffected
  • ba85c644ac8dc37d9b01a3332c2f142cb4d46954 to before 3974ea1938406f9bfa7c1f48d4e43533f447bb08Affected
LinuxLinux
  • 6.12Affected
  • before 6.12Not affected
  • 6.18.34 through 6.18.*Not affected
  • 7.0.11 through 7.0.*Not affected
  • 7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.