CVE-2026-98893 firmware: arm_scmi: Validate SENSOR_UPDATE payload size

Not scored Published 23 Oct 2026 Updated 26 Oct 2026

Exploited in the wild: Not known
Fix: Available

What is CVE-2026-98893?

CVE-2026-98893 is a vulnerability in Linux, published on 23 Oct 2026.

Official description

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_scmi: Validate SENSOR_UPDATE payload size

SENSOR_UPDATE carries one or more sensor readings after the fixed notification header. The parser derives the expected reading count from the sensor description, but it did not verify that the received payload contains those entries before parsing them.

Reject truncated update notifications before reading the variable array.

Which versions are affected by CVE-2026-98893?

How do I fix CVE-2026-98893?

Upgrade to a fixed version.

Is CVE-2026-98893 being exploited?

There is no known exploitation of CVE-2026-98893 in the wild and no public exploit code.

Sources

Also known as AZL-110644, BELL-CVE-2026-98893, DEBIAN-CVE-2026-98893, GHSA-x3wq-mmx9-56pr, UBUNTU-CVE-2026-98893.