The Linux kernel's KVM arm64 component had a vulnerability (CVE-2025-40266) where the offset used in FF-A memory sharing was not properly validated. This lack of validation allowed an untrusted offset value, close to U32_MAX, to cause out-of-bounds memory access in the hypervisor. The vulnerability was resolved by implementing checks on the offset to ensure it does not exceed safe bounds, preventing potential memory corruption or escalation of privileges in the hypervisor context.

If exploited, this vulnerability could allow an attacker with high privileges on the host to cause out-of-bounds memory access in the hypervisor, potentially leading to confidentiality, integrity, and availability compromises of the virtualized environment. The CVSS vector indicates local attack vector with low attack complexity, requiring high privileges and no user interaction, with scope change and high impact on confidentiality, integrity, and availability.

A fix for this vulnerability has been implemented in the Linux kernel. Users and administrators should apply the official kernel updates that include the patch for CVE-2025-40266 to ensure the offset validation is enforced. Since this is a kernel-level vulnerability, updating to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; therefore, check the official Linux kernel advisories for the exact patched versions and update accordingly.