CVE-2026-98893

A flaw was found in the Linux kernel's ARM System Control and Management Interface (SCMI) sensor driver. The driver fails to verify that the received notification payload size is large enough to contain all expected sensor readings before parsing them. A malicious or compromised firmware platform can send a truncated sensor update notification, triggering an out-of-bounds read that may lead to a Denial of Service (DoS) via a system crash or information disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.