PT-2026-61397 · Linux · Linux

CVE-2026-64080 · Published 2026-07-19 · Updated 2026-07-19

NVD

CVSS v3.1

9.3

Critical

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm ffa: Snapshot notifier callbacks under lock

Both notification handlers currently look up a notifier callback under notify lock, drop the lock, and then dereference the returned notifier entry. A concurrent unregister can delete and free that entry in the gap, leaving the handler to dereference stale memory.

Copy the callback pointer and callback data while notify lock is still held and invoke the callback only after the lock is dropped. This keeps the existing callback execution model while removing the use-after-free window in both the framework and non-framework notification paths.

Fix

Related Identifiers

CVE-2026-64080

Affected Products

Linux

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-64080 · Security Note
• https://git.kernel.org/stable/c/38290b180a4d5746baed796d49f88d56d2f336cd · Note
• https://git.kernel.org/stable/c/0e7be42ef2490f19d859a6146324d48cafdc9d5c · Note
• https://git.kernel.org/stable/c/d1e38551fadea230649bc428f0f35c9ee062a072 · Note