Description
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit()
Sashiko (locally) reports multiple out-of-bound issues in
ffa_setup_and_transmit:
1) Writing ep_mem_access->reserved can write out of bounds for FFA
versions < 1.2 as ffa_emad_size_get() returns 16 bytes in that case
while reserved has an offset of 24.
Instead of zeroing fields, memset the struct to zero first based on
the FFA version.
2) Make sure there is enough size to write constituents.
While at it, convert the only sizeof() in the driver that uses a
type instead of variable.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 6.1.31 – < 6.1.191, 5.15.114 – < 5.16, 6.3.5 – < 6.4, 6.4 | 6.1.191 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 7.1.6-1 | — |
| Debian 13 | linux | 6.12.115-2 | — |
| Debian 12 | linux | No fix yet | — |
| Debian 12 | linux-6.12 | 6.12.115-2~deb12u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Nvidia-BlueField 24.04 LTS | linux-bluefield | No fix yet | — |
| Ubuntu Nvidia-BlueField 22.04 LTS | linux-bluefield | No fix yet | — |
| Ubuntu 26.04 LTS | linux | 7.0.0-38.38 | USN-8887-1 |
| Ubuntu 26.04 LTS | linux-aws +1 | 7.0.0-1014.14 | USN-8887-1 |
| Ubuntu 26.04 LTS | linux-azure | 7.0.0-1017.17 | USN-8888-1 |
| Ubuntu 26.04 LTS | linux-azure-fde | 7.0.0-1016.16 | USN-8888-1 |
| Ubuntu 26.04 LTS | linux-gke | 7.0.0-1008.9 | USN-8887-1 |
| Ubuntu 26.04 LTS | linux-ibm +1 | 7.0.0-1015.15 | USN-8889-1, USN-8887-1 |
| Ubuntu 26.04 LTS | linux-nvidia | 7.0.0-1025.26 | USN-9043-1 |
| Ubuntu 26.04 LTS | linux-nvidia-bos | 7.0.0-2022.23 | USN-9003-1 |
| Ubuntu 26.04 LTS | linux-oracle | 7.0.0-1013.13 | USN-8887-1 |
| Ubuntu 26.04 LTS | linux-raspi | 7.0.0-1023.23 | USN-9021-1 |
| Ubuntu 26.04 LTS | linux-riscv +1 | 7.0.0-38.38.1 | USN-8887-1 |
| Ubuntu 24.04 LTS | linux +43 | No fix yet | — |
| Ubuntu 24.04 LTS | linux-aws-7.0 +1 | 7.0.0-1014.14~24.04.1 | USN-8887-3, USN-8887-2 |
| Ubuntu 24.04 LTS | linux-azure-7.0 | 7.0.0-1017.17~24.04.1 | USN-8888-2 |
| Ubuntu 24.04 LTS | linux-azure-fde-7.0 | 7.0.0-1016.16~24.04.1 | USN-8888-2 |
| Ubuntu 24.04 LTS | linux-hwe-7.0 | 7.0.0-38.38~24.04.4 | USN-8887-3 |
| Ubuntu 24.04 LTS | linux-nvidia-7.0 | 7.0.0-1024.25~24.04.1 | USN-9003-1 |
| Ubuntu 24.04 LTS | linux-nvidia-tegra | 6.8.0-1036.39 | USN-8886-1 |
| Ubuntu 24.04 LTS | linux-oracle-7.0 | 7.0.0-1013.13~24.04.1 | USN-8887-3 |
| Ubuntu 24.04 LTS | linux-riscv-7.0 | 7.0.0-38.38.1~24.04.1 | — |
| Ubuntu 22.04 LTS | linux +59 | No fix yet | — |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime +3 | No fix yet | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime +2 | No fix yet | — |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-preview 22.04 LTS | linux-aws-fips +2 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | linux-aws-5.15 +10 | No fix yet | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | kernel-livepatch-6.18.44-99.149 +1 | 1:1.0-0.amzn2023 | ALAS2023-2026-3402, ALAS2023-2026-2106 |
| Amazon Linux 2023 | perf6.12 +11 | 1:6.12.114-139.210.amzn2023 | ALAS2023-2026-3402 |
| Amazon Linux 2023 | perf6.18 +12 | 1:6.18.44-99.149.amzn2023 | ALAS2023-2026-2106 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kernel | 6.6.161.1-1 | — |
Advisories 13
- USN-9021-1 linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- WID-SEC-2026-2730 Linux Kernel: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- USN-9043-1 linux-nvidia vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8887-1 linux, linux-aws, linux-gcp, linux-gke, linux-ibm, linux-oracle, linux-realtime vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-9003-1 linux-nvidia-7.0, linux-nvidia-bos vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8887-3 linux-gcp-7.0, linux-hwe-7.0, linux-oracle-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8888-2 linux-azure-7.0, linux-azure-fde-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8888-1 linux-azure, linux-azure-fde vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8887-2 linux-aws-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8889-1 linux-oem-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8886-1 linux-nvidia-tegra vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- ALAS2023-2026-3402 Important: kernel6.12 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 11, 2026
- ALAS2023-2026-2106 Important: kernel6.18 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 9, 2026
References
- https://git.kernel.org/stable/c/500f92f398c717aa515afd23c7a38c0e7f4a1dc9
- https://git.kernel.org/stable/c/d312a71b19bb83803c8d1372bc042bd36db657f7
- https://git.kernel.org/stable/c/00bef9d0f9e787f56ff4699d3b577983ff8b7f24
- https://git.kernel.org/stable/c/cf5708c9d78c98214c62b1e5d049cd527a543b8e
- https://git.kernel.org/stable/c/27abdaf0c5c89b06694e4c3d8318e8d6a60c1d1b
- https://git.kernel.org/stable/c/3383ffb7ef937317361713ffcc21921a7848511a