In the Linux kernel, the calculation of the starting address for an ARM FF‑A endpoint memory access array was incorrectly derived, using a fixed size of a memory region structure instead of the descriptor's ep_mem_offset field. This miscalc can place endpoint memory access blocks beyond their intended bounds, potentially leading to memory corruption or unauthorized reads and writes. The applied fix corrects the offset logic and adds sanity checks so that the calculated descriptor offsets never exceed the allowed fragment size, thereby complying with the FF‑A specification.

All Linux kernel releases that contain the buggy arm_ffa implementation are affected; no specific version range is provided, so the guidance applies to any kernel before the patches referenced in the advisory. The issue arises only on systems that use the ARM FF‑A firmware interface.

The CVSS score is 7.8, indicating a high‑severity flaw, while the EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the vulnerability could be exploited by an attacker who can trigger ARM FF‑A endpoint registrations or manipulate endpoint attributes, which would require kernel privileges. No public exploit has been reported, and the vulnerability appears confined to the kernel’s internal memory handling for FF‑A endpoints.