Not yet scoredPublished Aug 11, 2026

CVE-2026-68444firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()

Updated under an hour ago (Oct 27, 2026, 10:40 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() ffa_partition_info_get() passes uuid_str directly to uuid_parse() without a NULL check. When a caller passes NULL, uuid_parse() -> __uuid_parse() -> uuid_is_valid() dereferences the pointer, causing a kernel panic: | Unable to handle kernel NULL pointer dereference at virtual address | 0000000000000040 | pc : uuid_parse+0x40/0xac | lr : ffa_partition_info_get+0x1c/0x94 [arm_ffa] Add a NULL guard before uuid_parse() so a NULL argument returns -ENODEV instead of crashing. Callers are expected to always supply a valid partition UUID, so NULL is not a supported input.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Aug 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from d0c0bce831223b08e5bade2cefc93c3ddb790796 before 7dfb020e3048411fbca91e9ad6174da9a2d3e2b3; from d0c0bce831223b08e5bade2cefc93c3ddb790796 before ddf85f0c32e05baafbd9c3a44859858db90eec48; from d0c0bce831223b08e5bade2cefc93c3ddb790796 before 86f5ea90f73bb7154593bb96f3411e197f3d4fbe; from d0c0bce831223b08e5bade2cefc93c3ddb790796 before 7201e56e52d18abf4cd0a2fee45daf9dc08b5b97; from d0c0bce831223b08e5bade2cefc93c3ddb790796 before 996c5c19d5b5ac5b98a7b5a406b548305841c301; from d0c0bce831223b08e5bade2cefc93c3ddb790796 before 12a42c610e4432e7708cc48d607e5903fffe0aad; from d0c0bce831223b08e5bade2cefc93c3ddb790796 before 8ae5f8e4836667fcaffdf2e3c6068b0a8b364dd8	CNA record

References

References

https://git.kernel.org/stable/c/7dfb020e3048411fbca91e9ad6174da9a2d3e2b3
https://git.kernel.org/stable/c/ddf85f0c32e05baafbd9c3a44859858db90eec48
https://git.kernel.org/stable/c/86f5ea90f73bb7154593bb96f3411e197f3d4fbe
https://git.kernel.org/stable/c/7201e56e52d18abf4cd0a2fee45daf9dc08b5b97
https://git.kernel.org/stable/c/996c5c19d5b5ac5b98a7b5a406b548305841c301
https://git.kernel.org/stable/c/12a42c610e4432e7708cc48d607e5903fffe0aad
https://git.kernel.org/stable/c/8ae5f8e4836667fcaffdf2e3c6068b0a8b364dd8

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.