In the Linux kernel, a use‑after‑free race condition exists in the ARM FFA snapshot notifier subsystem. The notifier handlers obtain a callback pointer while holding notify_lock, release the lock, then dereference the pointer. During this window an unregister can concurrently delete the callback, freeing the memory and leaving the handler with a stale pointer. Dereferencing the freed memory corrupts kernel memory, potentially allowing an attacker to execute arbitrary code with kernel privileges. This flaw corresponds to CWE-825.

All Linux kernel distributions that provide the arm_ffa snapshot notifier module on ARM architectures are affected. The advisory does not enumerate specific kernel release numbers, so any kernel version that includes the unpatched arm_ffa notifier code is vulnerable. Current patched releases have incorporated the fix that copies the callback pointer while the lock is held.

The CVSS base score of 9.3 indicates a critical severity. The EPSS score of less than 1% shows a low likelihood of automated exploitation today. It is not listed in CISA’s KEV catalog. The CVE description does not explicitly give an attack vector, but based on the described behavior it is inferred that an actor who can trigger notification registration and unregistration locally—such as a privileged user or one capable of loading a malicious kernel module—could trigger the race and achieve kernel memory corruption. No remote network trigger is described.