Look up another CVE · open CVE-2026-68400 in the interactive tracker
CVE-2026-68400
firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation
Published 2026-08-10 (2 months ago) by the Linux kernel CNA. Subsystem drivers/firmware. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-68400 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | vulnerable | 6.12.113-1 | No fix published anywhere yet, neither in Debian nor upstream for the series trixie tracks. Watch the Debian tracker page for this CVE. Advisories for trixie have historically landed a median of 11 days after publication. |
| Debian 14forky | fixed | 7.1.6-1 | Update the kernel and reboot. Fixed in 7.1.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.6-1 | Update the kernel and reboot. Fixed in 7.1.6-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Use the descriptor's `ep_mem_offset` to calculate the start of the endpoint memory access array and to comply with the FF-A spec instead of defaulting to `sizeof(struct ffa_mem_region)`. This requires moving `ffa_mem_region_additional_setup()` earlier in the setup flow. Also, add sanity checks to ensure the calculated descriptor offsets do not exceed `max_fragsize`.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/firmware/arm_ffa/driver.c
include/linux/arm_ffa.h
- What this is
- FIRMWARE FRAMEWORK FOR ARMV8-AMAINTAINERS section matched on drivers/firmware/arm_ffa/ · linux-arm-kernel@lists.infradead.org · Maintained
Show whether Debian builds this, per release
Not established. This site could not find the build rule for the affected file in the kernel trees Debian ships, so it has no answer about whether Debian compiles this code. Read that as unknown, never as absent.
- bookworm, trixie, forky, sid?
- ?
- not established - no Makefile entry for the affected file
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS
Signals
- Published
- 2026-08-10 (2 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.13%, higher than 2.1% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- drivers/firmware
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.7 | 6.18.42 | b39b08e6bee8 |
| 6.7 | 7.1.6 | 8ef18f0ab3c0 |
| 6.7 | 7.2 | b4d961351aa8 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The vulnerable FF-A memory-descriptor setup is reached only through local kernel interfaces — TEE device ioctls (/dev/tee*) driving optee/tstee shared-memory registration and lend paths, or host-side FF-A SMC handling. No network or remote packet input reaches this code.
- AC:LAttack complexity, low
- The out-of-bounds descriptor writes follow deterministically from the endpoint count and offsets used to build the transaction; no race, no memory-layout luck, and no condition outside the attacker's influence is needed to drive the unvalidated offset arithmetic past max_fragsize.
- PR:LPrivileges required, low
- An unprivileged local process holding a handle to the TEE device node (common on Android/embedded ARM systems, where TEE clients are ordinary user processes) can drive ffa_setup_and_transmit() via shared-memory registration/lend operations; no root or capability check gates that path.
- UI:NUser interaction, none
- The vulnerable path is entered directly from the attacker's own ioctl/FF-A operations; no action by another user or administrator is required.
- S:UScope, unchanged
- The out-of-bounds writes corrupt kernel memory adjacent to the FF-A TX buffer within the same kernel security authority, so impact is scored as Unchanged even though the same offset confusion also feeds the pKVM/secure-world descriptor parsing.
- C:HConfidentiality impact, high
- Descriptor offsets computed without validation against max_fragsize let structured data be placed and read back outside the intended buffer, and the resulting heap corruption is leverageable into disclosure of adjacent kernel memory, including data later handed to the secure world.
- I:HIntegrity impact, high
- This is an out-of-bounds write of attacker-influenced endpoint descriptor fields (receiver, attrs, composite_off, impdef values) plus a memset past the end of the TX buffer, giving heap corruption that can be groomed into a control-flow or data-structure overwrite primitive.
- A:HAvailability impact, high
- Writing endpoint memory access descriptors beyond the RX/TX buffer corrupts unrelated kernel allocations and readily produces an oops or panic, and the mis-parsed descriptor can also drive the memory transaction into an inconsistent state with the secure partition.