CVE-2026-68400

The vulnerability in CVE-2026-68400 stems from an offset calculation error in the ARM Firmware Framework for Armv8-A (FF-A) driver. Developers replaced the spec-required `ep_mem_offset` field with a hardcoded `sizeof(struct ffa_mem_region)` — a structural assumption that breaks when descriptors use variable-length layouts, which the FF-A specification explicitly permits. The original code performed zero bounds validation on descriptor offsets, meaning an attacker-controlled `ep_mem_offset` could point anywhere in the buffer. What makes this serious is the trust boundary implications. FF-A exists specifically to enable memory sharing between Normal world (Linux) and Secure world (TEE/secure OS). An offset miscalculation that lets a descriptor reference arbitrary memory doesn't just threaten the kernel's memory allocator — it can poison memory regions being offered to trusted components. The blast radius isn't contained by the firmware boundary; it flows through it. The fix adds bounds checks ensuring descriptor offsets don't exceed `max_fragsize`, and moves `ffa_mem_region_additional_setup()` earlier in the initialization flow — suggesting the validation logic existed but wasn't integrated into the code path that needed it. That reordering is a load-bearing architectural change; audit code that assumed the original (buggy) initialization ordering. The pattern here — semantic fields replaced with compile-time sizeof constants — isn't unique to FF-A. Similar vulnerabilities have appeared in ACPI table parsers and SMCCC implementations. The sizeof substitution is invisible to runtime fuzzing because the code always takes that path regardless of input. Check other FF-A structures, particularly notification descriptor handling, for identical assumptions. Review any recent firmware interface drivers merged in the last two years for this pattern — the kernel's review process tends to validate against reference firmware rather than malformed inputs, making this a recurring vulnerability class at interface adoption points.

Reviewed through automated stages and approved by a human before publication.