CVE-2025-40266

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw in the KVM arm64 component related to memory sharing with FF-A. Insufficient validation of offsets can lead to out-of-bounds access within the hypervisor when handling FF-A buffers. Specifically, an untrusted offset value from the host kernel, within the range of [U32 MAX - sizeof(struct ffa composite mem region) + 1, U32 MAX], was not properly checked, potentially allowing for memory corruption.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.