Skip to main content

Linux Kernel CVE-2026-64081

| EUVDEUVD-2026-45654 HIGH
Out-of-bounds Write (CWE-787)
2026-07-19 Linux GHSA-jv9h-h3cq-mm9x
Buffer Overflow Linux Memory Corruption
8.4
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.4 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.3 MEDIUM

Malformed data must come from the firmware/secure-world trust boundary (PR:H, AV:L); realistic impact is memory disclosure (C:H) and crash/DoS (A:H), with limited integrity effect (I:L).

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:H
4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 17:17 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
8.4 (HIGH)
Patch available
Jul 19, 2026 - 17:03 EUVD
CVE Published
Jul 19, 2026 - 15:39 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 15:39 cve.org
HIGH 8.4

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_ffa: Validate framework notification message layout

Framework notifications carry an indirect message in the shared RX buffer. Validate the reported offset and size before using them, reject zero-length payloads, and ensure that any non-header payload starts at the UUID field rather than in the middle of the message header.

Use the validated offset and size values for both kmemdup() and the UUID parsing path so malformed firmware data cannot drive an out-of-bounds read or an oversized allocation.

AnalysisAI

Out-of-bounds read and oversized memory allocation in the Linux kernel's Arm Firmware Framework for A-profile (FF-A) driver (drivers/firmware/arm_ffa) arises from unvalidated offset and size fields in framework notification messages placed in the shared RX buffer. Malformed firmware-supplied data can drive an OOB read during UUID parsing or an oversized kmemdup() allocation, affecting kernels from 6.15 onward on Arm systems using FF-A. Rated CVSS 8.4 (local vector); no public exploit is identified and EPSS is low (0.17%), consistent with a firmware-trust-boundary issue rather than a broadly exploitable remote flaw.

Technical ContextAI

The Arm FF-A specification defines a partition/notification messaging interface between the normal-world OS (Linux) and secure-world firmware (e.g., TF-A/Hafnium) using shared memory buffers. Framework notifications deliver an indirect message located in the shared RX buffer, where the message header reports an offset and size for the payload that follows and which contains a UUID field. The vulnerable code trusted these firmware-reported offset/size values without bounds-checking them against the buffer, allowing a payload offset to point into the middle of the header, a zero-length payload, or a size exceeding the actual buffer. Passing these unchecked values to kmemdup() and the UUID parser produces a classic out-of-bounds read (CWE-125) and an untrusted-size allocation (CWE-789), even though the input CWE field is marked N/A. The CPE data identifies the affected component generically as Linux (cpe:2.3:a:linux:linux), and the tag 'Buffer Overflow' reflects the memory-safety class.

RemediationAI

Vendor-released patch: update to Linux stable 6.18.34, 7.0.11, or 7.1 (or later), which add validation of the framework notification offset/size and use the validated values for both kmemdup() and UUID parsing; the fixes are the git.kernel.org stable commits 3c51d99449dc5a01c08a7fce6071d6721f5aac83, 76eb90e2b03de147e12ab68ea8afd8ea0342df0a, and 4a1cc9e96b311d2609a6f963a5e35bd4ae730d97. Distribution kernels should pick up the corresponding backport. Because the driver only processes this data on Arm systems using the FF-A firmware interface, systems without FF-A are not exposed; where patching must be deferred, a compensating control is to avoid or disable the FF-A/secure-partition configuration if the platform does not require it (trade-off: loss of FF-A-based secure services), and to ensure the platform runs only trusted, signed secure-world firmware since the malicious input originates from the firmware side of the boundary. Vendor advisory tracking: https://nvd.nist.gov/vuln/detail/CVE-2026-64081.

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-64081 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy