CVE-2026-64520

HighCVSS 8.4/10Last modified Nov 3, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies

The register-based PARTITION_INFO_GET path trusted the firmware-provided indices when copying partition descriptors into the caller buffer. Reject inconsistent counts or index progressions so the copy loop cannot write past the allocated array.

(fixed cur_idx when exactly one descriptor in the first fragment)

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= ba85c644ac8dc37d9b01a3332c2f142cb4d46954, < f39bc7ebe75e2186b417a024a7f7e2fd4cc7eb95; >= ba85c644ac8dc37d9b01a3332c2f142cb4d46954, < 79d95c02ae0a95e6e80e8e92b7ca74ecee02854f; >= ba85c644ac8dc37d9b01a3332c2f142cb4d46954, < 3974ea1938406f9bfa7c1f48d4e43533f447bb08
LinuxLinux6.12

References

Timeline

Published
Jul 25, 2026
Last modified
Nov 3, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-64521In the Linux kernel, the following vulnerability has been resolved: pinctrl: meson: amlogic-a4: fix deadlock issue Accessing the pinconf-pCVE-2026-645228.8In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA mlx5e_CVE-2026-645239.8In the Linux kernel, the following vulnerability has been resolved: net/handshake: Take a long-lived file reference at submit handshake_nlCVE-2026-645247.7In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate resolution_count and fix WIN8 fallback A SYNTHVIDCVE-2026-64525In the Linux kernel, the following vulnerability has been resolved: xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit TheCVE-2026-64526In the Linux kernel, the following vulnerability has been resolved: ethtool: tsconfig: fix missing ethnl_ops_complete() tsconfig_prepare_dCVE-2026-64527In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate VMBus packet size in receive callback hyperv_receCVE-2026-64528In the Linux kernel, the following vulnerability has been resolved: tty: serial: samsung: Remove redundant port lock acquisition in rx helpCVE-2026-645297.8In the Linux kernel, the following vulnerability has been resolved: crypto: qat - remove unused character device and IOCTLs The QAT driverCVE-2026-64536.5The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficCVE-2026-645309.8In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle tcf_clCVE-2026-645317.8In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch st
CVE-2026-64520: High severity, CVSS 8.4 | Vulnix