Out-of-Bounds Access Vulnerability in Linux Kernel Hypervisor for ARM64

CVE-2025-40266

What is CVE-2025-40266?

A security issue in the Linux kernel's KVM subsystem for ARM64 architecture was identified, where an untrusted offset in the FF-A memory share could lead to out-of-bounds (OOB) access. This could allow a malicious host to manipulate large offset values, potentially leading to unauthorized access or manipulation of memory regions, thus posing a significant security risk. Proper verification of the offset is required to mitigate against such vulnerabilities, ensuring that any values passed to the hypervisor are within acceptable limits to maintain system integrity.

References