CVE-2026-68400

Received Received - Intake

BaseFortify

Publication date: 2026-08-10

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation Use the descriptor's `ep_mem_offset` to calculate the start of the endpoint memory access array and to comply with the FF-A spec instead of defaulting to `sizeof(struct ffa_mem_region)`. This requires moving `ffa_mem_region_additional_setup()` earlier in the setup flow. Also, add sanity checks to ensure the calculated descriptor offsets do not exceed `max_fragsize`.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-17

Generated

2026-10-19

AI Q&A

2026-08-10

EPSS Evaluated

2026-10-18

NVD

CVE-2026-68400

EUVD

EUVD-2026-55586

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	113580530ee7dc61e668b641d657920734533b9f
Linux	Linux	113580530ee7dc61e668b641d657920734533b9f
Linux	Linux	113580530ee7dc61e668b641d657920734533b9f
Linux	Linux	6.7

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves incorrect calculation of the Endpoint Memory Access Descriptor offset in the ARM FF-A (Firmware Framework for Arm) implementation. The issue arises from using a default value instead of the descriptor's `ep_mem_offset` to determine the start of the endpoint memory access array, which violates the FF-A specification.

Detection Guidance

This vulnerability is specific to the Linux kernel's firmware implementation for ARM FFA. Detection requires checking kernel logs for memory access descriptor errors or inspecting the kernel version for affected code paths. Commands like dmesg | grep ffa or checking kernel version with uname -a may help identify exposure.

Impact Analysis

This vulnerability could lead to improper memory access during firmware operations, potentially causing system instability, crashes, or unexpected behavior in systems using ARM FF-A. It may also expose systems to privilege escalation or denial-of-service attacks if exploited.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a specific memory access descriptor calculation issue in the Linux kernel's firmware component. No evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve the memory access descriptor calculation issue. If patches are unavailable, consider disabling ARM FFA functionality if not required, or restrict access to affected systems until updates are applied.

Hi! I’m here to help you understand CVE-2026-68400. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70