CVE-2026-98363

A flaw was found in the Linux kernel's ARM System Control and Power Interface (SCPI) driver. The driver fails to validate the upper bound of operating performance points returned by system firmware during power management configuration. A compromised or malicious firmware environment could return an excessively large count, causing an out-of-bounds memory read and misallocated memory tables. This flaw primarily leads to memory corruption and a system crash, resulting in a Denial of Service (DoS).

An out of bounds read in the ARM SCPI DVFS path occurs because scpi_dvfs_get_info trusted a firmware supplied opp_count larger than MAX_DVFS_OPPS. A malformed SCP firmware response can make the kernel read beyond the fixed buf.opps array and construct an OPP table using invalid data. For the CVSS the PR:H because an attacker must control or compromise the privileged SCP firmware or its trusted shared memory response. The issue is not network reachable through normal SCPI use. Impact is primarily availability through invalid DVFS data and possible platform instability. No confidentiality or integrity impact is demonstrated because the patch does not show an information disclosure primitive or an out of bounds write.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.