CVE-2026-98363
Description
A flaw was found in the Linux kernel's ARM System Control and Power Interface (SCPI) driver. The driver fails to validate the upper bound of operating performance points returned by system firmware during power management configuration. A compromised or malicious firmware environment could return an excessively large count, causing an out-of-bounds memory read and misallocated memory tables. This flaw primarily leads to memory corruption and a system crash, resulting in a Denial of Service (DoS).
Statement
An out of bounds read in the ARM SCPI DVFS path occurs because scpi_dvfs_get_info trusted a firmware supplied opp_count larger than MAX_DVFS_OPPS. A malformed SCP firmware response can make the kernel read beyond the fixed buf.opps array and construct an OPP table using invalid data. For the CVSS the PR:H because an attacker must control or compromise the privileged SCP firmware or its trusted shared memory response. The issue is not network reachable through normal SCPI use. Impact is primarily availability through invalid DVFS data and possible platform instability. No confidentiality or integrity impact is demonstrated because the patch does not show an information disclosure primitive or an out of bounds write.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.4 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | High | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
