CVE-2026-64080 describes a use-after-free vulnerability in the Linux kernel's arm_ffa firmware notification mechanism. Notification handlers looked up a notifier callback under a lock, then released the lock before dereferencing the callback. This allowed a concurrent unregister operation to delete and free the notifier entry, causing handlers to dereference stale memory. The patch changes the logic to copy the callback pointer and data while still holding the lock and only invoke the callback after releasing the lock, preserving the callback execution model while removing the use-after-free condition.

The vulnerability could lead to kernel memory corruption or crashes due to dereferencing freed memory in the notification callback path. This may affect system stability or security depending on the context in which the callbacks are invoked. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to address this vulnerability by modifying the notification callback handling to prevent use-after-free. Users should apply the official kernel updates containing this patch when available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory or Linux kernel mailing lists for the specific fixed versions and update guidance.