Answer in brief
CVE-2026-64080 records a Unknown severity vulnerability in firmware: arm_ffa: Snapshot notifier callbacks under lock. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=285a5ea0f542db94c3ed11e01a71abb47d15cbf5 <d1e38551fadea230649bc428f0f35c9ee062a072 || >=285a5ea0f542db94c3ed11e01a71abb47d15cbf5 <0e7be42ef2490f19d859a6146324d48cafdc9d5c || >=285a5ea0f542db94c3ed11e01a71abb47d15cbf5 <38290b180a4d5746baed796d49f88d56d2f336cd | d1e38551fadea230649bc428f0f35c9ee062a072, 0e7be42ef2490f19d859a6146324d48cafdc9d5c, 38290b180a4d5746baed796d49f88d56d2f336cd |
| Linux/Linuxgeneric | 6.15 | Not reported |
Published upstream
Jul 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Snapshot notifier callbacks under lock Both notification handlers currently look up a notifier callback under notify_lock, drop the lock, and then dereference the returned notifier entry. A concurrent unregister can delete and free that entry in the gap, leaving the handler to dereference stale memory. Copy the callback pointer and callback data while notify_lock is still held and invoke the callback only after the lock is dropped. This keeps the existing callback execution model while removing the use-after-free window in both the framework and non-framework notification paths.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-64080 records a Unknown severity vulnerability in firmware: arm_ffa: Snapshot notifier callbacks under lock. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=285a5ea0f542db94c3ed11e01a71abb47d15cbf5 <d1e38551fadea230649bc428f0f35c9ee062a072 || >=285a5ea0f542db94c3ed11e01a71abb47d15cbf5 <0e7be42ef2490f19d859a6146324d48cafdc9d5c || >=285a5ea0f542db94c3ed11e01a71abb47d15cbf5 <38290b180a4d5746baed796d49f88d56d2f336cd | d1e38551fadea230649bc428f0f35c9ee062a072, 0e7be42ef2490f19d859a6146324d48cafdc9d5c, 38290b180a4d5746baed796d49f88d56d2f336cd |
| Linux/Linuxgeneric | 6.15 | Not reported |
Published upstream
Jul 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Snapshot notifier callbacks under lock Both notification handlers currently look up a notifier callback under notify_lock, drop the lock, and then dereference the returned notifier entry. A concurrent unregister can delete and free that entry in the gap, leaving the handler to dereference stale memory. Copy the callback pointer and callback data while notify_lock is still held and invoke the callback only after the lock is dropped. This keeps the existing callback execution model while removing the use-after-free window in both the framework and non-framework notification paths.
Quoted source text, attributed separately from HOL analysis.