{"id":"CVE-2026-98893","kind":"vulnerability","aliases":["CVE-2026-98893"],"related":[],"title":"Linux kernel: truncated SCMI sensor updates read past payload bounds","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Validate SENSOR_UPDATE payload size\n\nSENSOR_UPDATE carries one or more sensor readings after the fixed\nnotification header. The parser derives the expected reading count\nfrom the sensor description, but it did not verify that the received\npayload contains those entries before parsing them.\n\nReject truncated update notifications before reading the variable\narray.","summary":"The Linux kernel's ARM SCMI firmware driver parsed SENSOR_UPDATE notifications without checking that the payload held all the sensor readings the description promised. A truncated notification could make the kernel read beyond the received buffer.","severity":"unknown","cvss":null,"epss":0.00215,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arm-scmi","firmware","infrastructure","linux"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-23T12:18:23+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:59:59+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.35,"triage":{"at":"2026-10-25T04:59:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Linux kernel: truncated SCMI sensor updates read past payload bounds","impact":"medium","summary":"The Linux kernel's ARM SCMI firmware driver parsed SENSOR_UPDATE notifications without checking that the payload held all the sensor readings the description promised. A truncated notification could make the kernel read beyond the received buffer.","category":"infrastructure","nicknames":[],"who_cares":["linux","arm-scmi","firmware"],"confidence":0.35,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Check the upstream kernel commit and NVD entry for the fixed kernel versions and whether a firmware-side sender can trigger it.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000508,"input_tokens":3365,"output_tokens":343,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98893':13A,16A 'arm':18B,27B,71C 'arm-scmi':17B 'array':125C 'beyond':56B 'bound':10A 'buffer':59B 'carri':80C 'check':36B 'contain':111C 'could':51B 'count':97C 'cve':11A,14A 'deriv':93C 'descript':46B,101C 'driver':30B 'entri':113C 'expect':95C 'firmwar':20B,29B,70C 'fix':88C 'follow':65C 'header':90C 'held':40B 'infrastructur':21B 'kernel':2A,25B,54B,63C 'linux':1A,22B,24B,62C 'make':52B 'notif':34B,50B,89C,120C 'one':81C 'pars':31B,115C 'parser':92C 'past':8A 'payload':9A,39B,76C,110C 'promis':47B 'read':7A,44B,55B,85C,96C,122C 'receiv':58B,109C 'reject':117C 'resolv':69C 'scmi':4A,19B,28B,72C 'sensor':5A,32B,43B,74C,78C,84C,100C 'size':77C 'truncat':3A,49B,118C 'updat':6A,33B,75C,79C,119C 'valid':73C 'variabl':124C 'verifi':106C 'vulner':66C 'without':35B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98893","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98893","severity":null,"published_at":"2026-10-23T12:18:23+00:00","modified_at":"2026-10-23T12:18:23+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98893","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98893","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}