Out-of-Bounds Write Vulnerability in Linux Kernel Affecting Firmware Components

CVE-2026-68401

What is CVE-2026-68401?

A vulnerability in the Linux kernel's firmware component may allow for out-of-bounds writes within the ffa_setup_and_transmit function. The issues arise from a mismatch in expected sizes when handling certain FFA versions, leading to possible data corruption or unexpected behavior. Specifically, if FFA versions are less than 1.2, the function may incorrectly calculate sizes, causing potential out-of-bounds writes when accessing reserved structures. To address this, modifications have been made to ensure that structures are appropriately zeroed out and that sufficient sizes are allocated for writes.

References