Bug 2507247 (CVE-2026-64520)

Summary:	CVE-2026-64520 kernel: firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's ARM Firmware Framework for ARM (FFA). The PARTITION_INFO_GET_REGS function, which handles copying partition descriptors, did not adequately validate the indices provided by the firmware. This oversight could allow the system to process inconsistent data, resulting in an out-of-bounds write. Such an issue can lead to memory corruption, potentially causing system instability or a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-25 10:12:41 UTC

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies

The register-based PARTITION_INFO_GET path trusted the firmware-provided
indices when copying partition descriptors into the caller buffer.
Reject inconsistent counts or index progressions so the copy loop cannot
write past the allocated array.

(fixed cur_idx when exactly one descriptor in the first fragment)

Comment 1 TEJ RATHI 2026-07-29 07:38:45 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026072538-CVE-2026-64520-82ff@gregkh/T