CVE-2026-68401

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The FF-A memory transaction code is reached only from local kernel clients, in practice from userspace via TEE_IOC_SHM_REGISTER/protmem allocation on /dev/tee0 (OP-TEE over FF-A) or /dev/tee_ts0 (Arm TS TEE). There is no network or adjacent-network path to ffa_setup_and_transmit().

AC:LAttack complexity, low

The out-of-bound EMAD write occurs deterministically on every memory share/lend whenever the negotiated FF-A version is below 1.2 (the common case, since ffa_emad_size_get() returns 16 while the reserved field sits at offset 24), and the attacker fully controls the registered buffer size and page layout that drive the constituent/fragment loop. No race or unknown state is involved.

PR:LPrivileges required, low

An unprivileged local user with access to the TEE device node (typically world- or tee-group-accessible on Android and Arm embedded/automotive systems) can call TEE_IOC_SHM_REGISTER and reach ffa_setup_and_transmit(); no capability check exists along the path.

UI:NUser interaction, none

The attacker triggers the memory-sharing path entirely through its own ioctl calls on the TEE device; no action by another user or administrator is needed.

S:UScope, unchanged

The corruption occurs in the kernel's own RX/TX descriptor buffer and adjacent kernel memory, all within the kernel's security authority; no hypervisor, IOMMU, or secure-world boundary is crossed by the overflow itself.

C:HConfidentiality impact, high

The out-of-bounds writes corrupt kernel memory neighbouring the FF-A descriptor buffer (a page allocated with alloc_pages_exact() whose neighbours are arbitrary kernel objects); such heap corruption can be shaped into a read primitive, and it also leaves adjacent kernel data reflected in the descriptor handed to the secure world.

I:HIntegrity impact, high

This is a kernel out-of-bounds write: 8 zero bytes past each 16-byte EMAD slot, plus a full 16-byte constituent entry containing attacker-influenced physical addresses and page counts written past the end of the TX buffer due to the missing sizeof() in the bound check, giving a controlled heap overwrite usable for privilege escalation.

A:HAvailability impact, high

Writing past the descriptor buffer corrupts adjacent kernel allocations and the memory descriptor passed to the secure world, readily causing kernel oops/panic or an aborted secure-world transaction, and the overflow is triggerable repeatedly by an unprivileged user.