CVE-2026-98893

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98893", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.378Z", "datePublished": "2026-10-23T11:37:54.017Z", "dateUpdated": "2026-10-26T06:56:19.302Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-26T06:56:19.302Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Validate SENSOR_UPDATE payload size\n\nSENSOR_UPDATE carries one or more sensor readings after the fixed\nnotification header. The parser derives the expected reading count\nfrom the sensor description, but it did not verify that the received\npayload contains those entries before parsing them.\n\nReject truncated update notifications before reading the variable\narray."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/firmware/arm_scmi/sensors.c"], "versions": [{"version": "e3811190acf85c63518fbddaa28bcbfab2baa58d", "lessThan": "e543d60f966a5f5c92298720c2fd1810f85a6be3", "status": "affected", "versionType": "git"}, {"version": "e3811190acf85c63518fbddaa28bcbfab2baa58d", "lessThan": "87a72e75f7560ea45cd28870194eaa153dd19e75", "status": "affected", "versionType": "git"}, {"version": "e3811190acf85c63518fbddaa28bcbfab2baa58d", "lessThan": "1bbe431fc59704d012660647516f6f94ddd82564", "status": "affected", "versionType": "git"}, {"version": "e3811190acf85c63518fbddaa28bcbfab2baa58d", "lessThan": "c148ff2f5a168e0bc41d801efca6ee35a376cfcb", "status": "affected", "versionType": "git"}, {"version": "e3811190acf85c63518fbddaa28bcbfab2baa58d", "lessThan": "767789a58ae0d65ec3028e5b5b4da82210355d00", "status": "affected", "versionType": "git"}, {"version": "e3811190acf85c63518fbddaa28bcbfab2baa58d", "lessThan": "32bc5496b48174dbca1f187f710955ee4d9527a1", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/firmware/arm_scmi/sensors.c"], "versions": [{"version": "5.11", "status": "affected"}, {"version": "0", "lessThan": "5.11", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e543d60f966a5f5c92298720c2fd1810f85a6be3"}, {"url": "https://git.kernel.org/stable/c/87a72e75f7560ea45cd28870194eaa153dd19e75"}, {"url": "https://git.kernel.org/stable/c/1bbe431fc59704d012660647516f6f94ddd82564"}, {"url": "https://git.kernel.org/stable/c/c148ff2f5a168e0bc41d801efca6ee35a376cfcb"}, {"url": "https://git.kernel.org/stable/c/767789a58ae0d65ec3028e5b5b4da82210355d00"}, {"url": "https://git.kernel.org/stable/c/32bc5496b48174dbca1f187f710955ee4d9527a1"}], "title": "firmware: arm_scmi: Validate SENSOR_UPDATE payload size", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/firmware/arm_scmi/sensors.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e543d60f966a5f5c92298720c2fd1810f85a6be3", "status": "affected", "version": "e3811190acf85c63518fbddaa28bcbfab2baa58d", "versionType": "git"}, {"lessThan": "87a72e75f7560ea45cd28870194eaa153dd19e75", "status": "affected", "version": "e3811190acf85c63518fbddaa28bcbfab2baa58d", "versionType": "git"}, {"lessThan": "1bbe431fc59704d012660647516f6f94ddd82564", "status": "affected", "version": "e3811190acf85c63518fbddaa28bcbfab2baa58d", "versionType": "git"}, {"lessThan": "c148ff2f5a168e0bc41d801efca6ee35a376cfcb", "status": "affected", "version": "e3811190acf85c63518fbddaa28bcbfab2baa58d", "versionType": "git"}, {"lessThan": "767789a58ae0d65ec3028e5b5b4da82210355d00", "status": "affected", "version": "e3811190acf85c63518fbddaa28bcbfab2baa58d", "versionType": "git"}, {"lessThan": "32bc5496b48174dbca1f187f710955ee4d9527a1", "status": "affected", "version": "e3811190acf85c63518fbddaa28bcbfab2baa58d", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/firmware/arm_scmi/sensors.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.11"}, {"lessThan": "5.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Validate SENSOR_UPDATE payload size\n\nSENSOR_UPDATE carries one or more sensor readings after the fixed\nnotification header. The parser derives the expected reading count\nfrom the sensor description, but it did not verify that the received\npayload contains those entries before parsing them.\n\nReject truncated update notifications before reading the variable\narray."}], "id": "CVE-2026-98893", "lastModified": "2026-10-26T07:17:14.523", "metrics": {}, "published": "2026-10-23T12:18:23.207", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1bbe431fc59704d012660647516f6f94ddd82564"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/32bc5496b48174dbca1f187f710955ee4d9527a1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/767789a58ae0d65ec3028e5b5b4da82210355d00"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/87a72e75f7560ea45cd28870194eaa153dd19e75"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c148ff2f5a168e0bc41d801efca6ee35a376cfcb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e543d60f966a5f5c92298720c2fd1810f85a6be3"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: firmware: arm_scmi: Validate SENSOR_UPDATE payload size", "id": "2559557", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559557"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nfirmware: arm_scmi: Validate SENSOR_UPDATE payload size\nSENSOR_UPDATE carries one or more sensor readings after the fixed\nnotification header. The parser derives the expected reading count\nfrom the sensor description, but it did not verify that the received\npayload contains those entries before parsing them.\nReject truncated update notifications before reading the variable\narray.", "A flaw was found in the Linux kernel's ARM System Control and Management Interface (SCMI) sensor driver. The driver fails to verify that the received notification payload size is large enough to contain all expected sensor readings before parsing them. A malicious or compromised firmware platform can send a truncated sensor update notification, triggering an out-of-bounds read that may lead to a Denial of Service (DoS) via a system crash or information disclosure."], "name": "CVE-2026-98893", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98893\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98893\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98893.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,e543d60f966a5f5c92298720c2fd1810f85a6be3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,87a72e75f7560ea45cd28870194eaa153dd19e75)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,1bbe431fc59704d012660647516f6f94ddd82564)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c148ff2f5a168e0bc41d801efca6ee35a376cfcb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,767789a58ae0d65ec3028e5b5b4da82210355d00)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,32bc5496b48174dbca1f187f710955ee4d9527a1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.15.222)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.1.189)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.6.158)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.12.111)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.18.53)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.15.222,5.15.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.1.189,6.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.158,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.111,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.53,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,e543d60f966a5f5c92298720c2fd1810f85a6be3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,87a72e75f7560ea45cd28870194eaa153dd19e75)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,1bbe431fc59704d012660647516f6f94ddd82564)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c148ff2f5a168e0bc41d801efca6ee35a376cfcb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,767789a58ae0d65ec3028e5b5b4da82210355d00)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,32bc5496b48174dbca1f187f710955ee4d9527a1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.15.222)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.1.189)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.6.158)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.12.111)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.18.53)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.15.222,5.15.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.1.189,6.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.158,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.111,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.53,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-23T14:15:07.097498+00:00", "updated": "2026-10-27T09:45:06.904851+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}