High 8.2Published Dec 4, 2025

CVE-2025-40266KVM: arm64: Check the untrusted offset in FF-A memory share

Updated under an hour ago (Oct 27, 2026, 7:50 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Check the untrusted offset in FF-A memory share Verify the offset to prevent OOB access in the hypervisor FF-A buffer in case an untrusted large enough value [U32_MAX - sizeof(struct ffa_composite_mem_region) + 1, U32_MAX] is set from the host kernel.

CVSS: 8.2 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 6211753fdfd05af9e08f54c8d0ba3ee516034878 before fc3139d9f4c1fe1c7d5f25f99676bd8e9c6a1041; from 6211753fdfd05af9e08f54c8d0ba3ee516034878 before bc1909ef38788f2ee3d8011d70bf029948433051; from 6211753fdfd05af9e08f54c8d0ba3ee516034878 before f9f1aed6c8a3427900da3121e1868124854569c3; 6211753fdfd05af9e08f54c8d0ba3ee516034878 builds before 103e17aac09cdd358133f9e00998b75d6c1f1518	CNA record

References

References

https://git.kernel.org/stable/c/fc3139d9f4c1fe1c7d5f25f99676bd8e9c6a1041
https://git.kernel.org/stable/c/bc1909ef38788f2ee3d8011d70bf029948433051
https://git.kernel.org/stable/c/f9f1aed6c8a3427900da3121e1868124854569c3
https://git.kernel.org/stable/c/103e17aac09cdd358133f9e00998b75d6c1f1518

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.