The vulnerability exists in the Linux kernel's firmware arm_ffa component where the PARTITION_INFO_GET_REGS operation trusts firmware-supplied indices when copying partition descriptors. This trust leads to potential out-of-bounds writes past the allocated array if the indices or counts are inconsistent. The flaw was addressed by adding checks to reject inconsistent indices and by fixing the copy loop to prevent out-of-bounds memory writes. This vulnerability affects numerous specific versions of the linux-hwe-edge kernel prior to version 7.0.0-1010.10 and others as enumerated. The CVSS vector indicates local attack vector, low complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could result in out-of-bounds memory writes, potentially leading to system crashes, data corruption, or privilege escalation. The impact is rated as critical due to the high confidentiality, integrity, and availability impacts indicated by the CVSS vector. However, no known exploits are currently reported in the wild.

A fix is available that rejects inconsistent indices and corrects the copy loop behavior to prevent out-of-bounds writes. Users and administrators should apply the official patches for the affected linux-hwe-edge kernel versions as provided by their vendor or distribution. Patch status is confirmed by the presence of fixed versions beyond the affected ones. No additional mitigation is indicated by the vendor advisory.