{"id":"CVE-2026-98892","kind":"vulnerability","aliases":["CVE-2026-98892"],"related":[],"title":"Linux kernel: short SCMI error-event payloads read past the buffer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Validate BASE_ERROR_EVENT payload size\n\nBASE_ERROR_EVENT carries a variable number of message reports,\nwith the count encoded in error_status. The notification parser used\nthat count without checking whether the received payload contained all\nreported entries.\n\nReject truncated payloads before copying the report array.","summary":"The Linux kernel's ARM SCMI firmware driver trusted an error count in a BASE_ERROR_EVENT notification without checking the payload actually contained that many reports. A truncated payload makes the kernel copy past the received data, which can crash it or leak adjacent memory.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arm","infrastructure","linux-kernel","scmi"],"not_affected_if":["no-arm-scmi-firmware"],"how_to_check":"- unknown","fix":"- Move to a Linux kernel release that includes the fix for firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size; the sources do not name the version.\n- Check the kernel version with `uname -r` and compare against your distribution's advisory.","status":"open","published_at":"2026-10-23T12:18:23+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T05:00:01+00:00","updated_at":"2026-10-25T05:00:01+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T05:00:01Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a Linux kernel release that includes the fix for firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size; the sources do not name the version.\n- Check the kernel version with `uname -r` and compare against your distribution's advisory.","reach":"unknown","title":"Linux kernel: short SCMI error-event payloads read past the buffer","impact":"low","summary":"The Linux kernel's ARM SCMI firmware driver trusted an error count in a BASE_ERROR_EVENT notification without checking the payload actually contained that many reports. A truncated payload makes the kernel copy past the received data, which can crash it or leak adjacent memory.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","arm","scmi"],"confidence":0.4,"needs_auth":"unknown","worst_case":"kernel crash or out-of-bounds memory read from firmware messages","analyst_note":"Find the fixed kernel versions and stable backport commits in the NVD entry or the kernel.org stable tree, and confirm the attack path (firmware-originated only or reachable otherwise).","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-arm-scmi-firmware"],"who_is_affected":"Systems running a Linux kernel with the ARM SCMI firmware driver, typically ARM servers and boards that expose SCMI firmware management. The sources do not say which kernel versions are vulnerable or whether typical x86 hosts are affected. Teams not running ARM SCMI hardware are probably not exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000631,"input_tokens":3356,"output_tokens":590,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98892':15A,18A 'actual':47B 'adjac':69B 'arm':19B,29B,82C 'array':130C 'base':39B,85C,90C 'buffer':12A 'carri':93C 'check':44B,114C 'contain':48B,119C 'copi':58B,127C 'count':36B,102C,112C 'crash':65B 'cve':13A,16A 'data':62B 'driver':32B 'encod':103C 'entri':122C 'error':6A,35B,40B,86C,91C,105C 'error-ev':5A 'event':7A,41B,87C,92C 'firmwar':31B,81C 'follow':76C 'infrastructur':20B 'kernel':2A,23B,27B,57B,74C 'leak':68B 'linux':1A,22B,26B,73C 'linux-kernel':21B 'make':55B 'mani':50B 'memori':70B 'messag':98C 'notif':42B,108C 'number':96C 'parser':109C 'past':10A,59B 'payload':8A,46B,54B,88C,118C,125C 'read':9A 'receiv':61B,117C 'reject':123C 'report':51B,99C,121C,129C 'resolv':80C 'scmi':4A,24B,30B,83C 'short':3A 'size':89C 'status':106C 'truncat':53B,124C 'trust':33B 'use':110C 'valid':84C 'variabl':95C 'vulner':77C 'whether':115C 'without':43B,113C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the ARM SCMI firmware driver, typically ARM servers and boards that expose SCMI firmware management. The sources do not say which kernel versions are vulnerable or whether typical x86 hosts are affected. Teams not running ARM SCMI hardware are probably not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98892","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98892","severity":null,"published_at":"2026-10-23T12:18:23+00:00","modified_at":"2026-10-23T12:18:23+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}