Skip to main content

Linux Kernel CVE-2026-68401

| EUVDEUVD-2026-55587 HIGH
2026-08-10 Linux GHSA-hvgp-9g43-gqqw
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local access and low privilege required to invoke the FFA subsystem; kernel out-of-bounds write yields full C/I/A impact with no scope change beyond the kernel.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.7 HIGH
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 02:44 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
7.8 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 12:04 cve.org
HIGH 7.8
CVE Published
Aug 10, 2026 - 12:04 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit()

Sashiko (locally) reports multiple out-of-bound issues in ffa_setup_and_transmit:

  1. Writing ep_mem_access->reserved can write out of bounds for FFA

versions < 1.2 as ffa_emad_size_get() returns 16 bytes in that case while reserved has an offset of 24. Instead of zeroing fields, memset the struct to zero first based on the FFA version.

  1. Make sure there is enough size to write constituents.

While at it, convert the only sizeof() in the driver that uses a type instead of variable.

AnalysisAI

Out-of-bounds memory writes in the Linux kernel's ARM Firmware Framework for Armv8-A (FF-A) driver expose local low-privilege users to kernel memory corruption on affected ARM platforms. Two distinct write-past-end defects exist in ffa_setup_and_transmit(): one triggered when the FFA protocol version is below 1.2 due to a struct size mismatch causing writes beyond allocated memory, and another from missing size validation before writing constituents. Upstream kernel patches are available across multiple stable branches (6.18.42, 7.1.6, 7.2-rc4); no public exploit or active exploitation has been identified at time of analysis, and EPSS probability is very low at 0.17%.

Technical ContextAI

The ARM Firmware Framework for Armv8-A (FF-A, also denoted FFA) is a software protocol enabling communication between the normal world and secure world (TrustZone) on ARM processors, mediated by platform firmware. The affected code resides in drivers/firmware/arm_ffa/ in the Linux kernel. The primary defect arises because ffa_emad_size_get() returns 16 bytes for FFA protocol versions below 1.2, yet the code writes to ep_mem_access->reserved at a struct offset of 24 bytes - a classic out-of-bounds write (CWE-787, though NVD has not formally assigned a CWE) caused by a version-conditional struct layout not being respected before field access. The secondary defect is an insufficient size check before writing memory constituents. Both are corrected upstream by zeroing structs via memset scoped to the FFA version before accessing fields, and by adding proper bounds validation. The CPE strings (cpe:2.3:a:linux:linux) cover all Linux kernel builds containing this driver; however, only ARM platforms with firmware implementing the FFA ABI will load and exercise this code path.

RemediationAI

Update the Linux kernel to a patched release: 6.18.42 or later for the 6.18.x stable series, 7.1.6 or later for the 7.1.x series, or 7.2-rc4 or later. Upstream fix commits are published at https://git.kernel.org/stable/c/cf5708c9d78c98214c62b1e5d049cd527a543b8e, https://git.kernel.org/stable/c/27abdaf0c5c89b06694e4c3d8318e8d6a60c1d1b, and https://git.kernel.org/stable/c/3383ffb7ef937317361713ffcc21921a7848511a across respective stable branches. For systems that cannot be immediately updated, a practical compensating control is to blacklist or unload the arm_ffa kernel module (add 'blacklist arm_ffa' to /etc/modprobe.d/ or run 'modprobe -r arm_ffa'), noting that this will disable normal-world to secure-world FF-A communication functionality and may break firmware-dependent services. Linux distribution vendors (Debian, Ubuntu, RHEL, SUSE, etc.) backporting these stable fixes to their own kernel packages should be checked via their respective security advisory channels.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-68401 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy