CVE-2026-98892

firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size

Published Oct 23, 2026 CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size

BASE_ERROR_EVENT carries a variable number of message reports,
with the count encoded in error_status. The notification parser used
that count without checking whether the received payload contained all
reported entries.

Reject truncated payloads before copying the report array.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`585dfab3fb80e67b3a54790b3d5ef2991feb3950`	affected	< 4a754704698017ced0b657c92b468035faad00ed
`585dfab3fb80e67b3a54790b3d5ef2991feb3950`	affected	< 28d65a0a46435d48b96b6943c518095dff1602a1
`585dfab3fb80e67b3a54790b3d5ef2991feb3950`	affected	< 890a9c3bf9dae90dcabded9d8e10c708a13779f7
`585dfab3fb80e67b3a54790b3d5ef2991feb3950`	affected	< c0742f23ec13fb6f5e0cd884323467a6c127d3c2
`585dfab3fb80e67b3a54790b3d5ef2991feb3950`	affected	< bd8bc95ef2daa3bac56197cffcbf2d4c5ed42216
`585dfab3fb80e67b3a54790b3d5ef2991feb3950`	affected	< cb77a50d1114c0c9e084176301a8e094d383edfa
`585dfab3fb80e67b3a54790b3d5ef2991feb3950`	affected	< 56e7e64cdd0e7209a58c8ec66028d63387402919

Linux

affected

Version	Status	Constraints
`5.9`	affected	—
`0`	unaffected	< 5.9
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4a754704698017ced0b657c92b468035faad00ed)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,28d65a0a46435d48b96b6943c518095dff1602a1)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,890a9c3bf9dae90dcabded9d8e10c708a13779f7)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c0742f23ec13fb6f5e0cd884323467a6c127d3c2)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,bd8bc95ef2daa3bac56197cffcbf2d4c5ed42216)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,cb77a50d1114c0c9e084176301a8e094d383edfa)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,56e7e64cdd0e7209a58c8ec66028d63387402919)`	affected	code_commit	—
`[0,5.10.271)`	affected	semver	—
`[0,5.15.222)`	affected	semver	—
`[0,6.1.189)`	affected	semver	—
`[0,6.6.158)`	affected	semver	—
`[0,6.12.111)`	affected	semver	—
`[0,6.18.53)`	affected	semver	—

Linux

Version	Status	Scheme	Platform
`[5.10.271,5.11.0)`	unaffected	semver	—
`[5.15.222,5.16.0)`	unaffected	semver	—
`[6.1.189,6.2.0)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4a754704698017ced0b657c92b468035faad00ed)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,28d65a0a46435d48b96b6943c518095dff1602a1)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,890a9c3bf9dae90dcabded9d8e10c708a13779f7)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c0742f23ec13fb6f5e0cd884323467a6c127d3c2)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,bd8bc95ef2daa3bac56197cffcbf2d4c5ed42216)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,cb77a50d1114c0c9e084176301a8e094d383edfa)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,56e7e64cdd0e7209a58c8ec66028d63387402919)`	affected	code_commit	—
`[0,5.10.271)`	affected	semver	—
`[0,5.15.222)`	affected	semver	—
`[0,6.1.189)`	affected	semver	—
`[0,6.6.158)`	affected	semver	—
`[0,6.12.111)`	affected	semver	—
`[0,6.18.53)`	affected	semver	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[5.10.271,5.11.0)`	unaffected	semver	—
`[5.15.222,5.16.0)`	unaffected	semver	—
`[6.1.189,6.2.0)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.187% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98892.mbox
https://git.kernel.org/stable/c/28d65a0a46435d48b96b6943c518095dff1602a1
https://git.kernel.org/stable/c/4a754704698017ced0b657c92b468035faad00ed
https://git.kernel.org/stable/c/56e7e64cdd0e7209a58c8ec66028d63387402919
https://git.kernel.org/stable/c/890a9c3bf9dae90dcabded9d8e10c708a13779f7
https://git.kernel.org/stable/c/bd8bc95ef2daa3bac56197cffcbf2d4c5ed42216
https://git.kernel.org/stable/c/c0742f23ec13fb6f5e0cd884323467a6c127d3c2
https://git.kernel.org/stable/c/cb77a50d1114c0c9e084176301a8e094d383edfa
https://nvd.nist.gov/vuln/detail/CVE-2026-98892
https://www.cve.org/CVERecord?id=CVE-2026-98892

History

Oct 27, 2026 9:15 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-787

Oct 27, 2026 4:30 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98892.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98892 https://www.cve.org/CVERecord?id=CVE-2026-98892
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Oct 23, 2026 3:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Oct 23, 2026 2:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-125 CWE-787

Oct 23, 2026 12:00 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size BASE_ERROR_EVENT carries a variable number of message reports, with the count encoded in error_status. The notification parser used that count without checking whether the received payload contained all reported entries. Reject truncated payloads before copying the report array.
Title		firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/28d65a0a46435d48b96b6943c518095dff1602a1 https://git.kernel.org/stable/c/4a754704698017ced0b657c92b468035faad00ed https://git.kernel.org/stable/c/56e7e64cdd0e7209a58c8ec66028d63387402919 https://git.kernel.org/stable/c/890a9c3bf9dae90dcabded9d8e10c708a13779f7 https://git.kernel.org/stable/c/bd8bc95ef2daa3bac56197cffcbf2d4c5ed42216 https://git.kernel.org/stable/c/c0742f23ec13fb6f5e0cd884323467a6c127d3c2 https://git.kernel.org/stable/c/cb77a50d1114c0c9e084176301a8e094d383edfa