PT-2026-61397 · Linux · Linux

CVE-2026-64080 · Publicado 2026-07-19 · Atualizado 2026-07-19

NVD

CVSS v3.1

9.3

Crítica

Vetor base

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm ffa: Snapshot notifier callbacks under lock

Both notification handlers currently look up a notifier callback under notify lock, drop the lock, and then dereference the returned notifier entry. A concurrent unregister can delete and free that entry in the gap, leaving the handler to dereference stale memory.

Copy the callback pointer and callback data while notify lock is still held and invoke the callback only after the lock is dropped. This keeps the existing callback execution model while removing the use-after-free window in both the framework and non-framework notification paths.

Correção

Identificadores relacionados

CVE-2026-64080

Produtos afetados

Linux

Referências · 4

• https://git.kernel.org/stable/c/38290b180a4d5746baed796d49f88d56d2f336cd · Nota
• https://git.kernel.org/stable/c/0e7be42ef2490f19d859a6146324d48cafdc9d5c · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-64080 · Nota de Segurança
• https://git.kernel.org/stable/c/d1e38551fadea230649bc428f0f35c9ee062a072 · Nota