CVE-2026-64080
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
19/07/2026
Last modified:
20/07/2026
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
firmware: arm_ffa: Snapshot notifier callbacks under lock<br />
<br />
Both notification handlers currently look up a notifier callback under<br />
notify_lock, drop the lock, and then dereference the returned<br />
notifier entry. A concurrent unregister can delete and free that<br />
entry in the gap, leaving the handler to dereference stale memory.<br />
<br />
Copy the callback pointer and callback data while notify_lock is<br />
still held and invoke the callback only after the lock is dropped.<br />
This keeps the existing callback execution model while removing the<br />
use-after-free window in both the framework and non-framework<br />
notification paths.
Impact
Base Score 3.x
9.30
Severity 3.x
CRITICAL