CVE-2026-64080 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_ffa: Snapshot notifier callbacks under lock
Both notification handlers currently look up a notifier callback under notify_lock, drop the lock, and then dereference the returned notifier entry. A concurrent unregister can delete and free that entry in the gap, leaving the handler to dereference stale memory.
Copy the callback pointer and callback data while notify_lock is still held and invoke the callback only after the lock is dropped. This keeps the existing callback execution model while removing the use-after-free window in both the framework and non-framework notification paths.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
This vulnerability exists within the Linux kernel's firmware subsystem, specifically in the arm_ffa component that handles ARM Foundation Firmware ABI communication. The issue stems from a race condition in the snapshot notifier callback mechanism where multiple threads can simultaneously access and modify the same notification handler data structures. The flaw creates a window of opportunity for memory corruption that can lead to system instability or potential privilege escalation.
The technical implementation flaw occurs when notification handlers perform a lookup operation under the notify_lock mutex, subsequently release the lock, and then proceed to dereference the retrieved notifier entry. During this brief window between lock release and callback execution, another thread may unregister and free the same notifier entry, creating a use-after-free condition. This pattern violates fundamental memory safety principles and creates a predictable attack surface for malicious actors attempting to exploit kernel memory corruption vulnerabilities.
The operational impact of this vulnerability extends beyond simple memory corruption, as it can potentially allow attackers to execute arbitrary code with kernel privileges. The race condition affects both framework and non-framework notification paths, meaning the vulnerability is widespread across different kernel components that rely on this notification mechanism. This type of flaw is particularly dangerous because it can be exploited to gain root access or cause denial-of-service conditions that compromise entire system operations.
The mitigation strategy involves modifying the callback execution flow to preserve both the callback pointer and associated data while the notify_lock remains acquired. This approach maintains the existing callback execution model while eliminating the use-after-free window by ensuring all necessary data is captured before releasing the lock. The solution aligns with established security practices for concurrent programming and memory management, addressing the root cause rather than merely patching symptoms. This fix demonstrates proper adherence to the principle of least privilege and memory safety in kernel development.
This vulnerability type maps directly to CWE-416 which describes use-after-free conditions, and it can be categorized under ATT&CK technique T1068 for exploit development through local privilege escalation. The ARM Foundation Firmware ABI implementation represents a critical interface point that requires robust concurrency controls to prevent such race conditions from compromising system integrity. The fix demonstrates proper kernel memory management practices and aligns with security standards emphasizing the importance of maintaining data consistency during concurrent access scenarios.
The solution approach reflects best practices for kernel-level race condition mitigation, specifically addressing the timing issue where lock acquisition and release create opportunities for memory corruption. By capturing all necessary execution context before releasing synchronization primitives, the implementation prevents the window where freed memory could be accessed by subsequent operations. This pattern represents a standard approach for resolving similar concurrency issues in kernel subsystems and ensures that notification handlers maintain data integrity throughout their execution lifecycle.
The fix maintains backward compatibility while strengthening the security posture of the Linux kernel's firmware interface. The approach preserves existing callback semantics and execution patterns, ensuring that legitimate system components continue to function normally while eliminating the exploitable race condition. This demonstrates the importance of careful synchronization design in kernel development and highlights how seemingly minor timing issues can create significant security vulnerabilities in low-level system interfaces.