CVE-2026-64081

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the arm ffa firmware component where framework notification messages in the shared RX buffer are not properly validated. Specifically, the system fails to verify the reported offset and size, does not reject zero-length payloads, and may allow non-header payloads to start within the message header instead of at the UUID field. This lack of validation can allow malformed firmware data to trigger an out-of-bounds read or an oversized allocation during kmemdup() and UUID parsing.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.