What is the CVSS score of CVE-2026-64080?

CVE-2026-64080 has a contested CVSS base score of 9.3 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-64080?

CVE-2026-64080 is a critical kernel vulnerability affecting Linux systems with Arm processors (specifically the arm_ffa driver) that could enable local privilege escalation through a use-after-free…. A patch is available.

How to fix or mitigate CVE-2026-64080?

Within 24 hours, inventory all systems running Linux kernel versions 6.15 through 6.18.33 or 7.0.0-7.0.10 on Arm-based platforms (including Arm servers, IoT devices, and embedded systems) to identify exposure scope and access patterns. Within 7 days, apply vendor-released patches (Kernel 6.18.34 or later for the 6.18 line, and Kernel 7.0.11 or later for the 7.0 line) to all affected systems in production environments and multi-tenant systems first. Within 30 days, complete patching across all remaining Arm-based infrastructure, verify patch deployment through kernel version audits, and document completion in your vulnerability management system.

Linux Kernel CVE-2026-64080

EUVD-2026-45653 CRITICAL

Use After Free (CWE-416)

2026-07-19 Linux

GHSA-jcvp-p3m6-xg77

Information Disclosure Linux Use After Free Memory Corruption

Critical

Disputed · 9.3 Vendor: Linux

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY

9.3 CRITICAL

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local-only race requires winning a timing window (AC:H) and local access to the FF-A notifier interface (PR:L); kernel UAF plausibly enables LPE or crash, so C/I/A:H, scope unchanged.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

6.4 MEDIUM

AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Red Hat

7.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 17:17 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

9.3 (CRITICAL)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:39 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 19, 2026 - 15:39 cve.org

CRITICAL 9.3

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_ffa: Snapshot notifier callbacks under lock

Both notification handlers currently look up a notifier callback under notify_lock, drop the lock, and then dereference the returned notifier entry. A concurrent unregister can delete and free that entry in the gap, leaving the handler to dereference stale memory.

Copy the callback pointer and callback data while notify_lock is still held and invoke the callback only after the lock is dropped. This keeps the existing callback execution model while removing the use-after-free window in both the framework and non-framework notification paths.

AnalysisAI

Kernel memory corruption in the Linux arm_ffa (Arm Firmware Framework for A-profile) driver allows a local attacker to trigger a use-after-free by racing notifier unregistration against active notification delivery, affecting Arm systems running kernels from 6.15 up to the fixed 6.18.34/7.0.11 releases. Both the framework and non-framework notification handlers looked up a callback under notify_lock, dropped the lock, then dereferenced a notifier entry that a concurrent unregister could have already freed. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 8th percentile), and it is not listed in CISA KEV.

Technical ContextAI

The affected component is the arm_ffa firmware driver (drivers/firmware/arm_ffa), which implements the Arm Firmware Framework for A-profile - a specification for communication between the normal world and secure-world partitions (e.g., TrustZone secure partitions, hypervisor/SPM services) on Arm64 platforms. The FF-A notification mechanism lets registered subscribers receive asynchronous events; the bug is a race in the two notification handlers that snapshot a notifier callback under notify_lock but invoke it after dropping the lock. If unregister runs in the window between lookup and dereference, the entry is deleted and freed, so the handler operates on stale memory. The root cause class is a use-after-free arising from a concurrency/race condition (CWE-416 combined with CWE-362); the CWE field was supplied as N/A in the source data. The fix copies the callback pointer and callback data while the lock is still held, preserving the execution model while closing the UAF window.

RemediationAI

Vendor-released patch: upgrade to Linux 6.18.34, 7.0.11, or mainline 7.1, or apply the backported stable commits d1e38551fadea230649bc428f0f35c9ee062a072 / 0e7be42ef2490f19d859a6146324d48cafdc9d5c / 38290b180a4d5746baed796d49f88d56d2f336cd from git.kernel.org; distribution kernels should be updated to the vendor build incorporating these fixes. If immediate patching is not possible, the most effective compensating control is to disable the Arm FF-A transport by building without CONFIG_ARM_FFA_TRANSPORT (or unloading/not loading the arm_ffa module) where secure-partition notifications are not required - the trade-off is loss of FF-A-based secure-world communication, so this is only viable on systems that do not depend on TrustZone/SPM services. Because exploitation is local, restricting untrusted local code execution and tightening access to the driver interface reduces the practical attack surface until the kernel is updated. Patch commits: https://git.kernel.org/stable/c/d1e38551fadea230649bc428f0f35c9ee062a072 and the two companion commits above.

Same weakness CWE-416 – Use After Free

View all

CVE-2019-0708 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2014-0322 HIGH POC

8.8

CVE-2012-4792 HIGH POC

8.8

CVE-2009-4324 HIGH POC

7.8

CVE-2015-0313 CRITICAL POC

9.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2013-2551 HIGH POC

8.8

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-64080 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64080

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-416 – Use After Free

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code