Linux Kernel CVE-2026-68400

Exploitation requires: (1) a local user account with at least low-privilege access (PR:L per CVSS), meaning no anonymous or remote unauthenticated exploitation is possible; (2) the target system must use Arm TrustZone-capable hardware with FF-A-compliant firmware, meaning the arm_ffa kernel driver must be loaded and active; (3) the kernel version must be 6.7 or later but prior to the patched releases (6.18.42, 7.1.6, or 7.2-rc4). Systems running x86/x86_64, RISC-V, or Arm hardware without TrustZone/FF-A firmware are not affected. No special non-default configuration is required beyond the hardware and driver preconditions above. The attack is not remotely triggerable and cannot be automated across networks.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) correctly reflects a local, low-privilege attack with full CIA impact, which is consistent with a kernel-level memory corruption bug. However, the EPSS score of 0.17% at the 6th percentile strongly indicates that real-world exploitation is not occurring at scale, and the vulnerability is not listed in CISA KEV. The arm_ffa subsystem is only exercised on Arm TrustZone-based hardware - the attack surface is therefore limited to systems with FF-A-capable firmware, narrowing the realistic population of exposed deployments compared to what the raw CVSS score might imply. Patches are confirmed available (7.2-rc4, 6.18.42, 7.1.6), and no POC exploit code has been identified. Overall, this warrants prompt patching on affected Arm platforms but does not represent an active crisis; even a mid-sized municipal IT team in rybnik running x86 infrastructure would have no exposure at all.

A local attacker with a standard user account on an Arm TrustZone-enabled system running an unpatched Linux kernel (6.7 through pre-patch) triggers memory access descriptor parsing via the arm_ffa subsystem. The incorrectly computed ep_mem_offset causes out-of-bounds memory access in the kernel, which the attacker leverages to corrupt kernel memory structures and elevate privileges to root. No public POC or exploit code has been identified at time of analysis.