What is the CVSS score of CVE-2026-68400?

CVE-2026-68400 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-68400?

The Linux kernel arm_ffa firmware subsystem contains a privilege escalation vulnerability (CVE-2026-68400) that could allow local users to gain system-level access on Arm-based infrastructure.. A patch is available.

How to fix or mitigate CVE-2026-68400?

Within 24 hours, inventory all systems running Linux on Arm processors and identify which use the Firmware Framework for Armv8-A (FF-A) subsystem; prioritize production infrastructure and systems with elevated network exposure. Within 7 days, apply the vendor-released kernel patch addressing CVE-2026-68400 to all affected systems through your standard change management process, testing in non-production environments first. Within 30 days, verify patch deployment across all systems through vulnerability scanning or kernel version audits, and document the remediation in your security posture records.

Linux Kernel CVE-2026-68400

EUVD-2026-55586 HIGH

2026-08-10 Linux

GHSA-9fc3-h9fc-q4xw

Information Disclosure Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local attack vector confirmed by kernel driver context; PR:L because a standard user account suffices; full CIA impact consistent with kernel memory corruption leading to privilege escalation.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Red Hat

7.0 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 02:44 vuln.today

CVSS changed

Aug 13, 2026 - 23:37 NVD

7.8 (HIGH)

Patch available

Aug 10, 2026 - 14:18 EUVD

CVE Published

Aug 10, 2026 - 12:04 cve.org

HIGH 7.8

CVE Published

Aug 10, 2026 - 12:04 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation

Use the descriptor's ep_mem_offset to calculate the start of the endpoint memory access array and to comply with the FF-A spec instead of defaulting to sizeof(struct ffa_mem_region). This requires moving ffa_mem_region_additional_setup() earlier in the setup flow. Also, add sanity checks to ensure the calculated descriptor offsets do not exceed max_fragsize.

AnalysisAI

Incorrect offset calculation in the Linux kernel's arm_ffa firmware subsystem exposes local privilege escalation on systems using the Arm Firmware Framework for Armv8-A (FF-A). The flaw uses a hardcoded sizeof(struct ffa_mem_region) instead of the descriptor's ep_mem_offset field to locate the endpoint memory access array, violating the FF-A specification. A local user with low privileges could exploit this memory misinterpretation to achieve high confidentiality, integrity, and availability impact; no public exploit or active exploitation (KEV) has been identified at time of analysis.

Technical ContextAI

The vulnerability resides in the arm_ffa firmware driver within the Linux kernel, which implements the Arm Firmware Framework for Armv8-A (FF-A) - a standardized ABI for communication between Secure and Normal world partitions on Arm TrustZone-based systems. The bug is in endpoint memory access descriptor offset calculation: the code used a static struct size (sizeof(struct ffa_mem_region)) rather than the ep_mem_offset field embedded in the descriptor itself, causing the start of the endpoint memory access array to be computed incorrectly. This can cause out-of-bounds memory reads or writes relative to the descriptor. The fix also introduces bounds checks ensuring computed offsets do not exceed max_fragsize. The CWE is not formally assigned, but the root cause class is an incorrect pointer/offset calculation (analogous to CWE-682: Incorrect Calculation or CWE-125/787: out-of-bounds read/write). Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* starting from Linux 6.7.

RemediationAI

The primary fix is to upgrade the Linux kernel to a patched release: 6.18.42 for the stable 6.18 series, 7.1.6 for the 7.1 series, or 7.2-rc4 for the mainline release candidate. Upstream commits are available at the kernel.org stable tree links referenced in the CVE. Distribution maintainers (Red Hat, Ubuntu, Debian, SUSE, etc.) should be checked for backported stable kernel packages. If immediate patching is not possible on affected Arm TrustZone-based systems, restricting local user access to reduce exposure to low-privilege users is a compensating control, though it does not eliminate the vulnerability since PR:L is sufficient for exploitation. Disabling or blocking access to the arm_ffa module (rmmod arm_ffa or blacklisting it via /etc/modprobe.d/) may prevent exploitation on systems where FF-A is not operationally required, but this will disable Secure World partition communication and may affect firmware-dependent features. NVD advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-68400.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-68400 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-68400

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code