CVE-2026-68444: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-68444 is a NULL pointer dereference vulnerability in the Linux kernel's ARM Firmware Framework for Arm A-profile (FFA) subsystem, specifically in the ffa_partition_info_get() function. The flaw was published on August 12, 2026, and affects Linux kernel versions starting from 5.14 up through multiple stable branches. Fixed versions include 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc4. The CVSS base score is not yet formally assigned (estimated Medium severity) (GitHub Advisory).

The root cause is a missing NULL pointer validation (CWE-476: NULL Pointer Dereference) in ffa_partition_info_get(), which passes the uuid_str parameter directly to uuid_parse() without first checking whether it is NULL. When a NULL value is supplied, the call chain uuid_parse() → __uuid_parse() → uuid_is_valid() dereferences the NULL pointer at virtual address 0x0000000000000040, triggering a kernel panic. The crash manifests with pc: uuid_parse+0x40/0xac and lr: ffa_partition_info_get+0x1c/0x94 [arm_ffa]. The fix adds a NULL guard before the uuid_parse() call, returning -ENODEV for NULL inputs (GitHub Advisory).

Successful exploitation results in a kernel panic, causing a complete denial of service (system crash) on the affected host. The impact is limited to availability — confidentiality and integrity are not directly affected. Because the vulnerability resides in kernel space, a crash affects all processes and users on the system, and recovery requires a reboot (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the publication date (GitHub Advisory). Exploitation requires local access and the ability to invoke ffa_partition_info_get() with a NULL uuid_str argument, limiting the attack surface to privileged local users or processes interacting with the ARM FFA subsystem. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been reported.

Update to a patched Linux kernel version: 6.6.148, 6.12.101, 6.18.42, 7.1.6, or 7.2-rc4 and later. The fix introduces a NULL pointer guard in ffa_partition_info_get() so that a NULL uuid_str argument returns -ENODEV instead of causing a kernel panic. Systems not using ARM FFA firmware (i.e., non-ARM A-profile hardware) are not affected and do not require immediate action (GitHub Advisory).