CVE-2026-98363 firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS
A missing bounds check in the Linux kernel SCPI driver allows out-of-bounds reads and potential memory corruption via malicious firmware responses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98363?
CVE-2026-98363 is a memory corruption vulnerability in Linux, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS
scpi_dvfs_get_info() already rejected a zero opp_count, but still trusted any larger value from the SCP firmware. The shared-memory reply only holds MAX_DVFS_OPPS entries in buf.opps[]; a bigger count over-reads that array and then sizes the allocated OPP table incorrectly (garbage OPPs / OOB). The missing upper bound dates back to the original SCPI DVFS support.
Reject zero and out-of-range counts in one check and return -EINVAL.
Which versions are affected by CVE-2026-98363?
How do I fix CVE-2026-98363?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-98363 being exploited?
There is no known exploitation of CVE-2026-98363 in the wild and no public exploit code.
Sources
Also known as AZL-106212, BELL-CVE-2026-98363, DEBIAN-CVE-2026-98363, GHSA-33vh-pc87-q32x, UBUNTU-CVE-2026-98363.