CVE-2026-64520 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies
The register-based PARTITION_INFO_GET path trusted the firmware-provided indices when copying partition descriptors into the caller buffer. Reject inconsistent counts or index progressions so the copy loop cannot write past the allocated array.
(fixed cur_idx when exactly one descriptor in the first fragment)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/26/2026
The vulnerability identified in the Linux kernel's firmware subsystem relates to the arm_ffa component which handles communication with firmware through the Firmware Framework Architecture. This particular flaw exists within the PARTITION_INFO_GET_REGS interface that operates using register-based communication pathways. The vulnerability stems from insufficient validation of firmware-provided indices during the copying process of partition descriptors into caller buffers, creating a potential for buffer overflow conditions.
The technical implementation flaw occurs when the system processes partition information through the trusted firmware interface. During the copy operation from firmware-provided data structures to kernel buffers, the code fails to validate that the count values and index progressions remain consistent with the allocated buffer boundaries. This allows malicious or malformed firmware to provide inconsistent indices that could cause the copy loop to write beyond the intended memory allocation. The vulnerability specifically manifests when exactly one descriptor exists in the first fragment, where the current index calculation becomes incorrect, leading to potential overwriting of adjacent memory regions.
From an operational perspective, this vulnerability represents a significant security risk within embedded systems and mobile devices that rely on ARM Firmware Framework Architecture implementations. Attackers could potentially exploit this flaw by crafting malicious firmware responses that manipulate the index values to cause buffer overflows, which might lead to privilege escalation or arbitrary code execution within the kernel space. The impact extends beyond simple memory corruption as it affects the fundamental trust model between firmware and kernel components, potentially compromising the entire system security posture.
The vulnerability aligns with CWE-129 which addresses insufficient validation of the length of input data, and CWE-787 which covers out-of-bounds write conditions. From an ATT&CK framework perspective, this weakness maps to T1059.006 for execution through system binaries and potentially T1068 for privilege escalation. The fix implemented addresses the specific boundary condition by properly validating index progression and rejecting inconsistent counts before proceeding with memory operations. This remediation ensures that the copy loop operates within validated bounds regardless of firmware input, preventing potential exploitation through malformed partition descriptor sequences.
Mitigation strategies should focus on maintaining strict validation of all firmware-provided indices and implementing comprehensive bounds checking for all memory copy operations between firmware and kernel space. System administrators should ensure timely application of kernel updates containing this fix, particularly in environments where firmware integrity cannot be fully guaranteed. The solution also emphasizes the importance of defensive programming practices in kernel space where trust boundaries exist between different system components. Regular security audits of firmware interfaces and implementation of runtime checks for consistency validation can help prevent similar vulnerabilities from emerging in other kernel subsystems that handle external data processing.