Live › vulnerability › CVE-2026-98892
Go to dashboardThe Linux kernel's ARM SCMI firmware driver trusted an error count in a BASE_ERROR_EVENT notification without checking the payload actually contained that many reports. A truncated payload makes the kernel copy past the received data, which can crash it or leak adjacent memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the ARM SCMI firmware driver, typically ARM servers and boards that expose SCMI firmware management. The sources do not say which kernel versions are vulnerable or whether typical x86 hosts are affected. Teams not running ARM SCMI hardware are probably not exposed.
No product ranges from the sources yet.
uname -r and compare against your distribution's advisory.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size
BASE_ERROR_EVENT carries a variable number of message reports, with the count encoded in error_status. The notification parser used that count without checking whether the received payload contained all reported entries.
Reject truncated payloads before copying the report array.
This page as .md · .json · in your agent: get_signal("CVE-2026-98892")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.