The vulnerability allows a firmware component called arm_ffa to write beyond the bounds of a memory buffer during the ffa_setup_and_transmit operation. In firmware interfaces that support earlier versions of the FFA protocol (prior to 1.2), the driver incorrectly calculates the size of the reserved field and may overwrite adjacent memory while zeroing or populating fields. This out-of-bounds write corrupts kernel state, which can lead to arbitrary code execution with system privileges or cause the kernel to crash, resulting in a denial of service. The weakness is a classic out-of-bounds write identified by CWE-787.

The issue resides in the Linux kernel firmware subsystem. It is relevant to all Linux kernel installations that include the arm_ffa driver. No specific kernel release numbers are listed in the provided data, so any kernel version that has not yet incorporated the patch that zeroes the head struct or checks buffer sizes is potential risk. Linux vendor products are identified but no version constraints are given.

The CVSS base score is 7.8, indicating a high severity. The EPSS score is < 1%, suggesting a very low probability of exploitation at the time of analysis. This vulnerability is not listed in CISA’s KEV catalog, so no confirmed public exploits exist yet. The likely attack vector requires a crafted FFA request to the kernel, for example via user space or a virtual machine that interacts with the hypervisor interface. When FFA protocol versions below 1.2 are negotiated, the arm_ffa driver performs an out-of-bounds write during preparation of the request, which could corrupt kernel memory if the attacker can control the request payload or protocol version negotiation. The description indicates the write occurs before the kernel processes the request data.