CVE-2026-98363

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98363", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.344Z", "datePublished": "2026-10-06T08:46:49.235Z", "dateUpdated": "2026-10-19T09:18:15.202Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:18:15.202Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS\n\nscpi_dvfs_get_info() already rejected a zero opp_count, but still trusted\nany larger value from the SCP firmware. The shared-memory reply only holds\nMAX_DVFS_OPPS entries in buf.opps[]; a bigger count over-reads that array\nand then sizes the allocated OPP table incorrectly (garbage OPPs / OOB).\nThe missing upper bound dates back to the original SCPI DVFS support.\n\nReject zero and out-of-range counts in one check and return -EINVAL."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/firmware/arm_scpi.c"], "versions": [{"version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa", "lessThan": "e9887eeaa138c6b5697af3d2f7c71dc82407b154", "status": "affected", "versionType": "git"}, {"version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa", "lessThan": "1aadbef648e92ca642125f188f99b0a26628e3ba", "status": "affected", "versionType": "git"}, {"version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa", "lessThan": "7daaa684097377b66b98a832de307688a7f3bbc7", "status": "affected", "versionType": "git"}, {"version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa", "lessThan": "f17865332cc4ceaac846bcd7c28badbaedfabeff", "status": "affected", "versionType": "git"}, {"version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa", "lessThan": "0130f9ad3974a5b2ad0fa03d0b300a9fb83ed901", "status": "affected", "versionType": "git"}, {"version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa", "lessThan": "69ec03cd481973e4be44a7158ed6c0fa06a9a5f9", "status": "affected", "versionType": "git"}, {"version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa", "lessThan": "cc563a59aded6f3b02d75dcc3c0bc5e90755d99e", "status": "affected", "versionType": "git"}, {"version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa", "lessThan": "32471d84a487c7fd74532bc96be56f8028cf4a3f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/firmware/arm_scpi.c"], "versions": [{"version": "4.4", "status": "affected"}, {"version": "0", "lessThan": "4.4", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.54", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.8", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.18.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "7.2.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e9887eeaa138c6b5697af3d2f7c71dc82407b154"}, {"url": "https://git.kernel.org/stable/c/1aadbef648e92ca642125f188f99b0a26628e3ba"}, {"url": "https://git.kernel.org/stable/c/7daaa684097377b66b98a832de307688a7f3bbc7"}, {"url": "https://git.kernel.org/stable/c/f17865332cc4ceaac846bcd7c28badbaedfabeff"}, {"url": "https://git.kernel.org/stable/c/0130f9ad3974a5b2ad0fa03d0b300a9fb83ed901"}, {"url": "https://git.kernel.org/stable/c/69ec03cd481973e4be44a7158ed6c0fa06a9a5f9"}, {"url": "https://git.kernel.org/stable/c/cc563a59aded6f3b02d75dcc3c0bc5e90755d99e"}, {"url": "https://git.kernel.org/stable/c/32471d84a487c7fd74532bc96be56f8028cf4a3f"}], "title": "firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/firmware/arm_scpi.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e9887eeaa138c6b5697af3d2f7c71dc82407b154", "status": "affected", "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa", "versionType": "git"}, {"lessThan": "1aadbef648e92ca642125f188f99b0a26628e3ba", "status": "affected", "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa", "versionType": "git"}, {"lessThan": "7daaa684097377b66b98a832de307688a7f3bbc7", "status": "affected", "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa", "versionType": "git"}, {"lessThan": "f17865332cc4ceaac846bcd7c28badbaedfabeff", "status": "affected", "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa", "versionType": "git"}, {"lessThan": "0130f9ad3974a5b2ad0fa03d0b300a9fb83ed901", "status": "affected", "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa", "versionType": "git"}, {"lessThan": "69ec03cd481973e4be44a7158ed6c0fa06a9a5f9", "status": "affected", "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa", "versionType": "git"}, {"lessThan": "cc563a59aded6f3b02d75dcc3c0bc5e90755d99e", "status": "affected", "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa", "versionType": "git"}, {"lessThan": "32471d84a487c7fd74532bc96be56f8028cf4a3f", "status": "affected", "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/firmware/arm_scpi.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.4"}, {"lessThan": "4.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.54", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS\n\nscpi_dvfs_get_info() already rejected a zero opp_count, but still trusted\nany larger value from the SCP firmware. The shared-memory reply only holds\nMAX_DVFS_OPPS entries in buf.opps[]; a bigger count over-reads that array\nand then sizes the allocated OPP table incorrectly (garbage OPPs / OOB).\nThe missing upper bound dates back to the original SCPI DVFS support.\n\nReject zero and out-of-range counts in one check and return -EINVAL."}], "id": "CVE-2026-98363", "lastModified": "2026-10-19T10:18:39.177", "metrics": {}, "published": "2026-10-06T09:18:30.297", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0130f9ad3974a5b2ad0fa03d0b300a9fb83ed901"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1aadbef648e92ca642125f188f99b0a26628e3ba"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/32471d84a487c7fd74532bc96be56f8028cf4a3f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/69ec03cd481973e4be44a7158ed6c0fa06a9a5f9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7daaa684097377b66b98a832de307688a7f3bbc7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cc563a59aded6f3b02d75dcc3c0bc5e90755d99e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e9887eeaa138c6b5697af3d2f7c71dc82407b154"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f17865332cc4ceaac846bcd7c28badbaedfabeff"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS", "id": "2546378", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546378"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nfirmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS\nscpi_dvfs_get_info() already rejected a zero opp_count, but still trusted\nany larger value from the SCP firmware. The shared-memory reply only holds\nMAX_DVFS_OPPS entries in buf.opps[]; a bigger count over-reads that array\nand then sizes the allocated OPP table incorrectly (garbage OPPs / OOB).\nThe missing upper bound dates back to the original SCPI DVFS support.\nReject zero and out-of-range counts in one check and return -EINVAL.", "A flaw was found in the Linux kernel's ARM System Control and Power Interface (SCPI) driver. The driver fails to validate the upper bound of operating performance points returned by system firmware during power management configuration. A compromised or malicious firmware environment could return an excessively large count, causing an out-of-bounds memory read and misallocated memory tables. This flaw primarily leads to memory corruption and a system crash, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-98363", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98363\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98363\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98363.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8cb7cf56c9fe5412de238465b27ef35b4d2801aa,e9887eeaa138c6b5697af3d2f7c71dc82407b154)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8cb7cf56c9fe5412de238465b27ef35b4d2801aa,1aadbef648e92ca642125f188f99b0a26628e3ba)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8cb7cf56c9fe5412de238465b27ef35b4d2801aa,7daaa684097377b66b98a832de307688a7f3bbc7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8cb7cf56c9fe5412de238465b27ef35b4d2801aa,f17865332cc4ceaac846bcd7c28badbaedfabeff)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8cb7cf56c9fe5412de238465b27ef35b4d2801aa,0130f9ad3974a5b2ad0fa03d0b300a9fb83ed901)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8cb7cf56c9fe5412de238465b27ef35b4d2801aa,69ec03cd481973e4be44a7158ed6c0fa06a9a5f9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8cb7cf56c9fe5412de238465b27ef35b4d2801aa,cc563a59aded6f3b02d75dcc3c0bc5e90755d99e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8cb7cf56c9fe5412de238465b27ef35b4d2801aa,32471d84a487c7fd74532bc96be56f8028cf4a3f)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.10.271,5.10.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.15.222,5.15.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.1.189,6.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.158,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.112,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.54,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.8,7.2.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-06T13:30:08.245942+00:00", "updated": "2026-10-09T03:30:06.901700+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-125", "CWE-129", "CWE-20"]}