Linux Kernel Vulnerability in ARM SCMI Firmware Data Handling

CVE-2026-98893

What is CVE-2026-98893?

A vulnerability in the Linux kernel's ARM SCMI firmware allows inadequate validation of SENSOR_UPDATE payload sizes. The vulnerability occurs when the parser attempts to derive the expected number of sensor readings from the sensor's descriptions without verifying that the actual payload received matches these expectations. This oversight could lead to the acceptance of malformed or truncated update notifications, potentially resulting in data misrepresentation or denial of service when the system attempts to process data that isn't fully present.

References