CVE-2026-98362 clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate

Q: Is CVE-2026-98362 being exploited?

There is no known exploitation of CVE-2026-98362 in the wild and no public exploit code.

Not scored Published 6 Oct 2026 Updated 19 Oct 2026

A missing upper bound check in the Linux kernel SCPI clock driver allows out-of-bounds memory access, potentially causing crashes or information leaks.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-98362?

CVE-2026-98362 is a memory corruption vulnerability in Linux, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate

dvfs_get_idx() may return an out-of-range index if the SCP firmware is buggy or returns a stale value. Only negative indexes were rejected, so a large index walked past info->opps and could treat garbage as a clock rate (KASAN OOB / wrong frequency to consumers). The missing upper bound dates back to the original SCPI clock driver.

Treat indexes >= opp count as invalid and return 0, same as idx < 0.

Which versions are affected by CVE-2026-98362?

How do I fix CVE-2026-98362?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-98362 being exploited?