Buffer Overflow Vulnerability in Linux Kernel Affecting Firmware Interaction

CVE-2026-64520

What is CVE-2026-64520?

A vulnerability has been identified in the Linux kernel's handling of firmware data, specifically in the 'arm_ffa' module. This security flaw resides in the PARTITION_INFO_GET_REGS function, where improper validation of firmware-provided indices could lead to a buffer overflow. If an attacker were to exploit this weakness, they could send inconsistent counts or index progressions, causing the copy operation to write beyond allocated memory space. The issue has been addressed by ensuring that the counts and index progressions are correctly validated, thus enhancing the integrity of memory management within the kernel.

References