CVE-2026-98893

firmware: arm_scmi: Validate SENSOR_UPDATE payload size

State: Published
Severity: Not scored
Published: Oct 23, 2026
Updated: Oct 26, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_scmi: Validate SENSOR_UPDATE payload size

SENSOR_UPDATE carries one or more sensor readings after the fixed notification header. The parser derives the expected reading count from the sensor description, but it did not verify that the received payload contains those entries before parsing them.

Reject truncated update notifications before reading the variable array.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	e3811190acf85c63518fbddaa28bcbfab2baa58d to before e543d60f966a5f5c92298720c2fd1810f85a6be3Affected e3811190acf85c63518fbddaa28bcbfab2baa58d to before 87a72e75f7560ea45cd28870194eaa153dd19e75Affected e3811190acf85c63518fbddaa28bcbfab2baa58d to before 1bbe431fc59704d012660647516f6f94ddd82564Affected e3811190acf85c63518fbddaa28bcbfab2baa58d to before c148ff2f5a168e0bc41d801efca6ee35a376cfcbAffected e3811190acf85c63518fbddaa28bcbfab2baa58d to before 767789a58ae0d65ec3028e5b5b4da82210355d00Affected e3811190acf85c63518fbddaa28bcbfab2baa58d to before 32bc5496b48174dbca1f187f710955ee4d9527a1Affected
LinuxLinux	5.11Affected before 5.11Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

e3811190acf85c63518fbddaa28bcbfab2baa58d to before e543d60f966a5f5c92298720c2fd1810f85a6be3Affected
e3811190acf85c63518fbddaa28bcbfab2baa58d to before 87a72e75f7560ea45cd28870194eaa153dd19e75Affected
e3811190acf85c63518fbddaa28bcbfab2baa58d to before 1bbe431fc59704d012660647516f6f94ddd82564Affected
e3811190acf85c63518fbddaa28bcbfab2baa58d to before c148ff2f5a168e0bc41d801efca6ee35a376cfcbAffected
e3811190acf85c63518fbddaa28bcbfab2baa58d to before 767789a58ae0d65ec3028e5b5b4da82210355d00Affected
e3811190acf85c63518fbddaa28bcbfab2baa58d to before 32bc5496b48174dbca1f187f710955ee4d9527a1Affected

LinuxLinux

5.11Affected
before 5.11Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.