In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies

The register-based PARTITION_INFO_GET path trusted the firmware-provided
indices when copying partition descriptors into the caller buffer.
Reject inconsistent counts or index progressions so the copy loop cannot
write past the allocated array.

(fixed cur_idx when exactly one descriptor in the first fragment)

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
ba85c644ac8dc37d9b01a3332c2f142cb4d46954 affected < f39bc7ebe75e2186b417a024a7f7e2fd4cc7eb95
ba85c644ac8dc37d9b01a3332c2f142cb4d46954 affected < 79d95c02ae0a95e6e80e8e92b7ca74ecee02854f
ba85c644ac8dc37d9b01a3332c2f142cb4d46954 affected < 3974ea1938406f9bfa7c1f48d4e43533f447bb08
Linux Linux affected
Version Status Constraints
6.12 affected —
0 unaffected < 6.12
6.18.34 unaffected ≤ 6.18.*
7.0.11 unaffected ≤ 7.0.*
7.1 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/3974ea1938406f9bfa7c1f48d4e43533f447bb08 cve-icon
https://git.kernel.org/stable/c/79d95c02ae0a95e6e80e8e92b7ca74ecee02854f cve-icon
https://git.kernel.org/stable/c/f39bc7ebe75e2186b417a024a7f7e2fd4cc7eb95 cve-icon
History

Sat, 25 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies The register-based PARTITION_INFO_GET path trusted the firmware-provided indices when copying partition descriptors into the caller buffer. Reject inconsistent counts or index progressions so the copy loop cannot write past the allocated array. (fixed cur_idx when exactly one descriptor in the first fragment)
Title firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-07-25T09:14:46.005Z

Reserved: 2026-07-19T15:36:31.794Z

Link: CVE-2026-64520

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.