CVE-2026-98363

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS

scpi_dvfs_get_info() already rejected a zero opp_count, but still trusted

any larger value from the SCP firmware. The shared-memory reply only holds

MAX_DVFS_OPPS entries in buf.opps[]; a bigger count over-reads that array

and then sizes the allocated OPP table incorrectly (garbage OPPs / OOB).

The missing upper bound dates back to the original SCPI DVFS support.

Reject zero and out-of-range counts in one check and return -EINVAL.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References