A critical use-after-free vulnerability in the Linux kernel arm_ffa firmware driver poses a severe risk of system compromise and denial of service for local users.

The vulnerability exists in the arm_ffa firmware driver where notification handlers dereference notifier entries after dropping a required lock. This race condition allows a concurrent unregister operation to free the memory, resulting in a use-after-free condition that can be triggered by a local attacker without specific privileges.

The vulnerability carries a CVSS score of 9.3, classifying it as critical due to the potential for full system compromise. Because the flaw allows for privilege escalation and arbitrary code execution within the kernel context, an attacker could gain complete control over the affected system, exfiltrate sensitive data, or render the infrastructure unavailable.

Immediate Action: Update the Linux kernel to version 6.18.34, 7.0.11, or a later stable release where the notifier callback handling has been corrected.

Proactive Monitoring: Monitor system logs for kernel panic events or unexpected segmentation faults that may indicate exploitation attempts targeting memory-related vulnerabilities.

Compensating Controls: Restrict local access to systems running the affected kernel versions and implement strict kernel hardening policies to limit the potential impact of local privilege escalation.

Public Exploit Available: No

Given the critical nature of this kernel-level vulnerability and the potential for total system compromise, organizations should prioritize patching as part of their next scheduled maintenance window. Ensure that all downstream Linux distributions are updated as soon as upstream stable kernels are integrated into vendor repositories to mitigate the risk of local exploitation.