Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-25T00:00:00 kernel: firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-787

In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies The register-based PARTITION_INFO_GET path trusted the firmware-provided indices when copying partition descriptors into the caller buffer. Reject inconsistent counts or index progressions so the copy loop cannot write past the allocated array. (fixed cur_idx when exactly one descriptor in the first fragment)

A flaw was found in the Linux kernel's ARM Firmware Framework for ARM (FFA). The PARTITION_INFO_GET_REGS function, which handles copying partition descriptors, did not adequately validate the indices provided by the firmware. This oversight could allow the system to process inconsistent data, resulting in an out-of-bounds write. Such an issue can lead to memory corruption, potentially causing system instability or a denial of service.

Red Hat Enterprise Linux 10 Not affected kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Not affected kernel Red Hat Enterprise Linux 9 Not affected kernel-rt https://www.cve.org/CVERecord?id=CVE-2026-64520 https://nvd.nist.gov/vuln/detail/CVE-2026-64520 https://lore.kernel.org/linux-cve-announce/2026072538-CVE-2026-64520-82ff@gregkh/T