All vulnerabilities
CVE-2026-98892

Linux: firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in4a754704698017ced0b657c92b468035faad00edAlso 28d65a0a46435d48b96b6943c518095dff1602a1, 890a9c3bf9dae90dcabded9d8e10c708a13779f7 and 7 moreCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 4a754704698017ced0b657c92b468035faad00edLinuxCVE List
  • 28d65a0a46435d48b96b6943c518095dff1602a1LinuxCVE List
  • 890a9c3bf9dae90dcabded9d8e10c708a13779f7LinuxCVE List
  • 56e7e64cdd0e7209a58c8ec66028d63387402919LinuxCVE List
  • 5.10.271LinuxCVE List
  • 5.15.222LinuxCVE List
Show all 10 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size

BASE_ERROR_EVENT carries a variable number of message reports, with the count encoded in error_status. The notification parser used that count without checking whether the received payload contained all reported entries.

Reject truncated payloads before copying the report array.

Text from CVE List

Affected versions 20

  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 4a754704698017ced0b657c92b468035faad00edCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 28d65a0a46435d48b96b6943c518095dff1602a1CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 890a9c3bf9dae90dcabded9d8e10c708a13779f7CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before c0742f23ec13fb6f5e0cd884323467a6c127d3c2CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before bd8bc95ef2daa3bac56197cffcbf2d4c5ed42216CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before cb77a50d1114c0c9e084176301a8e094d383edfaCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 56e7e64cdd0e7209a58c8ec66028d63387402919CVE List
  • Linuxaffected: all versions before 5.10.271CVE List
  • Linuxaffected: all versions before 5.15.222CVE List
  • Linuxaffected: all versions before 6.1.189CVE List
  • Linuxaffected: all versions before 6.6.158CVE List
  • Linuxaffected: all versions before 6.12.111CVE List
  • Linuxaffected: all versions before 6.18.53CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 7