CVE-2026-68444 in Linux
Summary
by MITRE • 08/12/2026
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()
ffa_partition_info_get() passes uuid_str directly to uuid_parse() without a NULL check. When a caller passes NULL, uuid_parse() -> __uuid_parse() -> uuid_is_valid() dereferences the pointer, causing a kernel panic:
| Unable to handle kernel NULL pointer dereference at virtual address | 0000000000000040 | pc : uuid_parse+0x40/0xac | lr : ffa_partition_info_get+0x1c/0x94 [arm_ffa]
Add a NULL guard before uuid_parse() so a NULL argument returns -ENODEV instead of crashing. Callers are expected to always supply a valid partition UUID, so NULL is not a supported input.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/12/2026
This vulnerability exists in the Linux kernel's arm_ffa firmware driver where a null pointer dereference occurs in the ffa_partition_info_get() function. The issue stems from the absence of input validation before passing the uuid_str parameter to uuid_parse() function. When a caller provides a NULL value for uuid_str, the subsequent call chain uuid_parse() -> __uuid_parse() -> uuid_is_valid() attempts to dereference this null pointer at virtual address 0x40, resulting in an immediate kernel panic and system crash.
The technical flaw represents a classic null pointer dereference vulnerability that maps to CWE-476 which specifically addresses the use of NULL pointers in software applications. This type of vulnerability falls under the ATT&CK technique T1499.004 for Network Denial of Service and T1587.001 for Standard Application Layer Protocol, as it can be exploited to cause system instability and denial of service conditions. The root cause occurs because the function fails to validate input parameters before processing them, creating an execution path where unvalidated memory access leads to kernel termination.
The operational impact of this vulnerability is significant as it allows any user-space process or kernel module that invokes ffa_partition_info_get() with a NULL uuid_str parameter to trigger a complete system crash. This creates a denial of service condition that can be exploited by malicious actors to destabilize systems running affected kernel versions. The vulnerability specifically affects systems utilizing the ARM Firmware Framework Architecture (FFA) implementation, which is commonly found in secure execution environments and trusted computing platforms.
The mitigation strategy involves implementing a simple yet effective null pointer check before invoking uuid_parse() in the ffa_partition_info_get() function. This defensive programming approach ensures that when NULL input is detected, the function returns -ENODEV error code instead of allowing the kernel to crash. This change aligns with secure coding practices recommended by the CERT/CC Secure Coding Standards and follows the principle of least privilege by rejecting invalid inputs rather than attempting to process them. The fix maintains backward compatibility while preventing the kernel panic, ensuring that systems continue to operate normally even when malformed input is provided. The solution specifically addresses the ATT&CK tactic T1068 by preventing unauthorized system access through kernel-level vulnerabilities and aligns with the principle of input validation as outlined in NIST SP 800-160 standard for secure software development practices.