{"id":"CVE-2026-68400","title":"firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation\n\nUse the descriptor's `ep_mem_offset` to calculate the start of the endpoint\nmemory access a…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 113580530ee7dc61e668b641d657920734533b9f < 6e902bea625b710f8bf2f40b4ae4b14fa6a33f13","Linux >= 113580530ee7dc61e668b641d657920734533b9f < b39b08e6bee812514b449dc874076890e6b871a0","Linux >= 113580530ee7dc61e668b641d657920734533b9f < 8ef18f0ab3c0ec1eac77289f5a542bd96a8a6d66","Linux >= 113580530ee7dc61e668b641d657920734533b9f < b4d961351aa84fdf0148783fb1f3a1391b8a0adb","Linux 6.7"],"published":"2026-08-10","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:43:58.807Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68400","references":[{"url":"https://git.kernel.org/stable/c/6e902bea625b710f8bf2f40b4ae4b14fa6a33f13"},{"url":"https://git.kernel.org/stable/c/b39b08e6bee812514b449dc874076890e6b871a0"},{"url":"https://git.kernel.org/stable/c/8ef18f0ab3c0ec1eac77289f5a542bd96a8a6d66"},{"url":"https://git.kernel.org/stable/c/b4d961351aa84fdf0148783fb1f3a1391b8a0adb"}],"tags":["cve.org"],"epss":0.00127,"epssPercentile":0.02141,"ingestedAt":"2026-10-21T12:48:53.600Z","slug":"CVE-2026-68400","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation\n\nUse the descriptor's `ep_mem_offset` to calculate the start of the endpoint\nmemory access array and to comply with the FF-A spec instead of defaulting\nto `sizeof(struct ffa_mem_region)`.\nThis requires moving `ffa_mem_region_additional_setup()` earlier in the setup\nflow.\nAlso, add sanity checks to ensure the calculated descriptor offsets do not\nexceed `max_fragsize`.\n\n## Affected\n\n- `Linux >= 113580530ee7dc61e668b641d657920734533b9f < 6e902bea625b710f8bf2f40b4ae4b14fa6a33f13`\n- `Linux >= 113580530ee7dc61e668b641d657920734533b9f < b39b08e6bee812514b449dc874076890e6b871a0`\n- `Linux >= 113580530ee7dc61e668b641d657920734533b9f < 8ef18f0ab3c0ec1eac77289f5a542bd96a8a6d66`\n- `Linux >= 113580530ee7dc61e668b641d657920734533b9f < b4d961351aa84fdf0148783fb1f3a1391b8a0adb`\n- `Linux 6.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}