High [CVE-2026-64080] Snapshot notifier callbacks under lock

In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Snapshot notifier callbacks under lock Both notification handlers currently look up a notifier callback under notify_lock, drop the lock, and then dereference the returned notifier entry.

A concurrent unregister can delete and free that entry in the gap, leaving the handler to dereference stale memory. Copy the callback pointer and callback data while notify_lock is still held and invoke the callback only after the lock is dropped.

This keeps the existing callback execution model while removing the use-after-free window in both the framework and non-framework notification paths. A flaw was found in the Linux kernel's ARM Firmware Framework for Arm (FFA) component.

This vulnerability occurs because the system's notification handlers do not properly manage memory when processing callbacks. A timing issue can allow a callback to be unregistered and freed while it is still being accessed, leading to a use-after-free condition.

This can result in system instability or unexpected behavior. This vulnerability is rated as Moderate impact for Red Hat because triggering the race condition requires local system access and precise timing during unregistration of notification callbacks, restricting the blast radius primarily to local denial of service.