CVE-2026-98362

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98362", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.344Z", "datePublished": "2026-10-06T08:46:48.426Z", "dateUpdated": "2026-10-19T09:18:13.818Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:18:13.818Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate\n\ndvfs_get_idx() may return an out-of-range index if the SCP firmware is\nbuggy or returns a stale value. Only negative indexes were rejected, so a\nlarge index walked past info->opps and could treat garbage as a clock rate\n(KASAN OOB / wrong frequency to consumers). The missing upper bound dates\nback to the original SCPI clock driver.\n\nTreat indexes >= opp count as invalid and return 0, same as idx < 0."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/clk/clk-scpi.c"], "versions": [{"version": "cd52c2a4b5c43631e429d06dce12e08b0cab477f", "lessThan": "6e3b55823da8ef0d99621efb422cc29f50d7f280", "status": "affected", "versionType": "git"}, {"version": "cd52c2a4b5c43631e429d06dce12e08b0cab477f", "lessThan": "7204095917aeaac89db7377c29a457351a19b076", "status": "affected", "versionType": "git"}, {"version": "cd52c2a4b5c43631e429d06dce12e08b0cab477f", "lessThan": "0f89e2ac0e945da2ce798f6a61aebf9d291c2e0a", "status": "affected", "versionType": "git"}, {"version": "cd52c2a4b5c43631e429d06dce12e08b0cab477f", "lessThan": "56b7a9d89c67932bf11b71e3b6d17941fc24a393", "status": "affected", "versionType": "git"}, {"version": "cd52c2a4b5c43631e429d06dce12e08b0cab477f", "lessThan": "a82b274697d0876b478594ca78ad1e6cb062467b", "status": "affected", "versionType": "git"}, {"version": "cd52c2a4b5c43631e429d06dce12e08b0cab477f", "lessThan": "e1188332a9110cf3635fe286481ee38305b3c2b6", "status": "affected", "versionType": "git"}, {"version": "cd52c2a4b5c43631e429d06dce12e08b0cab477f", "lessThan": "108c46e8dacc4a0e472a74f98171115d49cbc079", "status": "affected", "versionType": "git"}, {"version": "cd52c2a4b5c43631e429d06dce12e08b0cab477f", "lessThan": "70f4b78d560e592cbf3325b162424737d032fc1d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/clk/clk-scpi.c"], "versions": [{"version": "4.4", "status": "affected"}, {"version": "0", "lessThan": "4.4", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.54", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.8", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.18.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "7.2.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6e3b55823da8ef0d99621efb422cc29f50d7f280"}, {"url": "https://git.kernel.org/stable/c/7204095917aeaac89db7377c29a457351a19b076"}, {"url": "https://git.kernel.org/stable/c/0f89e2ac0e945da2ce798f6a61aebf9d291c2e0a"}, {"url": "https://git.kernel.org/stable/c/56b7a9d89c67932bf11b71e3b6d17941fc24a393"}, {"url": "https://git.kernel.org/stable/c/a82b274697d0876b478594ca78ad1e6cb062467b"}, {"url": "https://git.kernel.org/stable/c/e1188332a9110cf3635fe286481ee38305b3c2b6"}, {"url": "https://git.kernel.org/stable/c/108c46e8dacc4a0e472a74f98171115d49cbc079"}, {"url": "https://git.kernel.org/stable/c/70f4b78d560e592cbf3325b162424737d032fc1d"}], "title": "clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/clk/clk-scpi.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6e3b55823da8ef0d99621efb422cc29f50d7f280", "status": "affected", "version": "cd52c2a4b5c43631e429d06dce12e08b0cab477f", "versionType": "git"}, {"lessThan": "7204095917aeaac89db7377c29a457351a19b076", "status": "affected", "version": "cd52c2a4b5c43631e429d06dce12e08b0cab477f", "versionType": "git"}, {"lessThan": "0f89e2ac0e945da2ce798f6a61aebf9d291c2e0a", "status": "affected", "version": "cd52c2a4b5c43631e429d06dce12e08b0cab477f", "versionType": "git"}, {"lessThan": "56b7a9d89c67932bf11b71e3b6d17941fc24a393", "status": "affected", "version": "cd52c2a4b5c43631e429d06dce12e08b0cab477f", "versionType": "git"}, {"lessThan": "a82b274697d0876b478594ca78ad1e6cb062467b", "status": "affected", "version": "cd52c2a4b5c43631e429d06dce12e08b0cab477f", "versionType": "git"}, {"lessThan": "e1188332a9110cf3635fe286481ee38305b3c2b6", "status": "affected", "version": "cd52c2a4b5c43631e429d06dce12e08b0cab477f", "versionType": "git"}, {"lessThan": "108c46e8dacc4a0e472a74f98171115d49cbc079", "status": "affected", "version": "cd52c2a4b5c43631e429d06dce12e08b0cab477f", "versionType": "git"}, {"lessThan": "70f4b78d560e592cbf3325b162424737d032fc1d", "status": "affected", "version": "cd52c2a4b5c43631e429d06dce12e08b0cab477f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/clk/clk-scpi.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.4"}, {"lessThan": "4.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.54", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate\n\ndvfs_get_idx() may return an out-of-range index if the SCP firmware is\nbuggy or returns a stale value. Only negative indexes were rejected, so a\nlarge index walked past info->opps and could treat garbage as a clock rate\n(KASAN OOB / wrong frequency to consumers). The missing upper bound dates\nback to the original SCPI clock driver.\n\nTreat indexes >= opp count as invalid and return 0, same as idx < 0."}], "id": "CVE-2026-98362", "lastModified": "2026-10-19T10:18:39.057", "metrics": {}, "published": "2026-10-06T09:18:30.090", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0f89e2ac0e945da2ce798f6a61aebf9d291c2e0a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/108c46e8dacc4a0e472a74f98171115d49cbc079"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/56b7a9d89c67932bf11b71e3b6d17941fc24a393"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6e3b55823da8ef0d99621efb422cc29f50d7f280"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/70f4b78d560e592cbf3325b162424737d032fc1d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7204095917aeaac89db7377c29a457351a19b076"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a82b274697d0876b478594ca78ad1e6cb062467b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e1188332a9110cf3635fe286481ee38305b3c2b6"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate", "id": "2546484", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546484"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in the Linux kernel's SCPI (System Control and Power Interface) clock driver. When recalculating clock rates, the driver fails to validate the upper bound of Dynamic Voltage and Frequency Scaling (DVFS) indices returned by system firmware. This issue allows an out-of-range index to trigger an out-of-bounds memory read, potentially causing a Denial of Service (DoS) through a kernel crash or system instability from corrupted clock frequency values."], "name": "CVE-2026-98362", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98362\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98362\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98362.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cd52c2a4b5c43631e429d06dce12e08b0cab477f,6e3b55823da8ef0d99621efb422cc29f50d7f280)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cd52c2a4b5c43631e429d06dce12e08b0cab477f,7204095917aeaac89db7377c29a457351a19b076)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cd52c2a4b5c43631e429d06dce12e08b0cab477f,0f89e2ac0e945da2ce798f6a61aebf9d291c2e0a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cd52c2a4b5c43631e429d06dce12e08b0cab477f,56b7a9d89c67932bf11b71e3b6d17941fc24a393)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cd52c2a4b5c43631e429d06dce12e08b0cab477f,a82b274697d0876b478594ca78ad1e6cb062467b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cd52c2a4b5c43631e429d06dce12e08b0cab477f,e1188332a9110cf3635fe286481ee38305b3c2b6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cd52c2a4b5c43631e429d06dce12e08b0cab477f,108c46e8dacc4a0e472a74f98171115d49cbc079)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cd52c2a4b5c43631e429d06dce12e08b0cab477f,70f4b78d560e592cbf3325b162424737d032fc1d)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.271,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.222,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.189,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.158,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.54,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.8,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-06T14:00:20.948633+00:00", "updated": "2026-10-08T17:45:19.567147+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}