---
id: "CVE-2026-98893"
kind: "vulnerability"
aliases: ["CVE-2026-98893"]
title: "Linux kernel: truncated SCMI sensor updates read past payload bounds"
severity: "unknown"
cvss: null
epss: 0.00215
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["arm-scmi", "firmware", "infrastructure", "linux"]
not_affected_if: []
published_at: "2026-10-23T12:18:23+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98893", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-98893", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Linux kernel: truncated SCMI sensor updates read past payload bounds

The Linux kernel's ARM SCMI firmware driver parsed SENSOR_UPDATE notifications without checking that the payload held all the sensor readings the description promised. A truncated notification could make the kernel read beyond the received buffer.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98893
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-98893

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_scmi: Validate SENSOR_UPDATE payload size

SENSOR_UPDATE carries one or more sensor readings after the fixed
notification header. The parser derives the expected reading count
from the sensor description, but it did not verify that the received
payload contains those entries before parsing them.

Reject truncated update notifications before reading the variable
array.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_