Out-of-bounds read in Linux kernel - CVE-2026-98363

Vulnerability details

The vulnerability allows a local user to cause out-of-bounds reads and populate the operating performance point table with invalid entries.

The vulnerability exists due to an out-of-bounds read caused by a missing upper-bound check in scpi_dvfs_get_info() when processing operating performance point counts from SCP firmware replies. A local user can supply a firmware reply with a count greater than MAX_DVFS_OPPS to cause out-of-bounds reads and populate the operating performance point table with invalid entries.

Affected software

How to mitigate CVE-2026-98363

External References

• https://git.kernel.org/stable/c/0130f9ad3974a5b2ad0fa03d0b300a9fb83ed901
• https://git.kernel.org/stable/c/1aadbef648e92ca642125f188f99b0a26628e3ba
• https://git.kernel.org/stable/c/32471d84a487c7fd74532bc96be56f8028cf4a3f
• https://git.kernel.org/stable/c/69ec03cd481973e4be44a7158ed6c0fa06a9a5f9
• https://git.kernel.org/stable/c/7daaa684097377b66b98a832de307688a7f3bbc7
• https://git.kernel.org/stable/c/cc563a59aded6f3b02d75dcc3c0bc5e90755d99e
• https://git.kernel.org/stable/c/e9887eeaa138c6b5697af3d2f7c71dc82407b154
• https://git.kernel.org/stable/c/f17865332cc4ceaac846bcd7c28badbaedfabeff

Related Security Bulletins

• Out-of-bounds read in Linux kernel firmware driver
• Debian update for linux