Linux Kernel EUVD-2026-55587

Exploitation requires all of the following: (1) a local account with at least low-privilege access (PR:L per CVSS) on the target system - no remote vector exists; (2) an ARM processor with Firmware Framework for Armv8-A (FF-A) support, meaning the arm_ffa kernel module must be loaded and the platform firmware must implement the FFA ABI (this excludes x86, MIPS, RISC-V, and ARM platforms without TrustZone firmware implementing FF-A); (3) to trigger the primary out-of-bounds write on ep_mem_access->reserved specifically, the FFA protocol negotiated with firmware must be below version 1.2 - systems running FFA 1.2 or later firmware are not vulnerable to the first defect (the constituents size defect may apply across versions). The low privilege requirement means a standard unprivileged shell account suffices; no administrator or root rights are needed to trigger the path. Remote exploitation is not possible per the local attack vector.

The NVD-assigned CVSS 7.8 High with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is a reasonable characterization: a local, low-privilege user who can invoke FFA subsystem calls may corrupt kernel memory, with full C/I/A impact consistent with kernel-level out-of-bounds writes and potential privilege escalation. However, the EPSS score of 0.17% (7th percentile) signals very low automated exploitation probability, and the vulnerability is absent from the CISA KEV catalog. No proof-of-concept exploit code has been identified. The gap between CVSS severity and EPSS is consistent with kernel driver vulnerabilities that require ARM-specific hardware, an FFA-capable platform running firmware implementing the ABI, and a local foothold - constraints that substantially reduce the realistic exposed attack surface compared to a remotely exploitable flaw. Real-world priority should be weighted toward ARM server and embedded deployments (AWS Graviton, Ampere, ARM-based infrastructure) where the FFA driver is actively loaded and used. x86 deployments are unaffected regardless of kernel version.

A local user with a standard unprivileged shell account on an ARM platform running an unpatched kernel - such as an AWS Graviton instance, an Ampere-based server, or an ARM-based container host - invokes the FFA subsystem with parameters that exercise the ffa_setup_and_transmit() path under FFA protocol version below 1.2. The version-mismatched struct size causes a write 8 bytes beyond the allocated ffa_emad buffer in kernel memory, potentially overwriting adjacent kernel data structures in a manner enabling privilege escalation to root. No public exploit code has been identified at time of analysis.