CVE-2026-80649

firmware: arm_scmi: Fix OOB in scmi_power_name_get()

State: Published
Severity: 7.8 High
Published: Aug 28, 2026
Updated: Aug 29, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_scmi: Fix OOB in scmi_power_name_get()

scmi_power_name_get() does not validate the domain number passed by the external caller, which may lead to an out-of-bounds access.

Fix this by returning "unknown" for invalid domains, like scmi_reset_name_get() does.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	76a6550990e296a7acbb4d33201c9740be912a8c to before 01613f5e4ff6c080260615392338e92e261d109bAffected 76a6550990e296a7acbb4d33201c9740be912a8c to before ca94597440fa546e56293abe9d0af6c73535d44eAffected 76a6550990e296a7acbb4d33201c9740be912a8c to before 30aa348494531adfb043b2e883afc0439e5fcdcaAffected 76a6550990e296a7acbb4d33201c9740be912a8c to before 0db2bb3c948ef8b7364768554d6ab5e1544dc441Affected 76a6550990e296a7acbb4d33201c9740be912a8c to before 11daac2817dca75e3eabb2050bc620c29e686fcdAffected 76a6550990e296a7acbb4d33201c9740be912a8c to before 11bb771f3c55b4cef3879e69da4ddecd6085569cAffected 76a6550990e296a7acbb4d33201c9740be912a8c to before f9ef3f66f4b18078e464b7606f9497e4dbeb9905Affected
LinuxLinux	4.17Affected before 4.17Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

76a6550990e296a7acbb4d33201c9740be912a8c to before 01613f5e4ff6c080260615392338e92e261d109bAffected
76a6550990e296a7acbb4d33201c9740be912a8c to before ca94597440fa546e56293abe9d0af6c73535d44eAffected
76a6550990e296a7acbb4d33201c9740be912a8c to before 30aa348494531adfb043b2e883afc0439e5fcdcaAffected
76a6550990e296a7acbb4d33201c9740be912a8c to before 0db2bb3c948ef8b7364768554d6ab5e1544dc441Affected
76a6550990e296a7acbb4d33201c9740be912a8c to before 11daac2817dca75e3eabb2050bc620c29e686fcdAffected
76a6550990e296a7acbb4d33201c9740be912a8c to before 11bb771f3c55b4cef3879e69da4ddecd6085569cAffected
76a6550990e296a7acbb4d33201c9740be912a8c to before f9ef3f66f4b18078e464b7606f9497e4dbeb9905Affected

LinuxLinux

4.17Affected
before 4.17Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.