CVE-2026-98892 - Vulnerability Details

- firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size

Description

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size

BASE_ERROR_EVENT carries a variable number of message reports,
with the count encoded in error_status. The notification parser used
that count without checking whether the received payload contained all
reported entries.

Reject truncated payloads before copying the report array.

Published: 2026-10-23

Score: n/a

EPSS: n/a

KEV: No

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 4a754704698017ced0b657c92b468035faad00ed
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 28d65a0a46435d48b96b6943c518095dff1602a1
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 890a9c3bf9dae90dcabded9d8e10c708a13779f7
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< c0742f23ec13fb6f5e0cd884323467a6c127d3c2
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< bd8bc95ef2daa3bac56197cffcbf2d4c5ed42216
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< cb77a50d1114c0c9e084176301a8e094d383edfa
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 56e7e64cdd0e7209a58c8ec66028d63387402919
`0`	affected	< 5.10.271
`0`	affected	< 5.15.222
`0`	affected	< 6.1.189
`0`	affected	< 6.6.158
`0`	affected	< 6.12.111
`0`	affected	< 6.18.53

Linux

affected

Version	Status	Constraints
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4a754704698017ced0b657c92b468035faad00ed)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,28d65a0a46435d48b96b6943c518095dff1602a1)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,890a9c3bf9dae90dcabded9d8e10c708a13779f7)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c0742f23ec13fb6f5e0cd884323467a6c127d3c2)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,bd8bc95ef2daa3bac56197cffcbf2d4c5ed42216)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,cb77a50d1114c0c9e084176301a8e094d383edfa)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,56e7e64cdd0e7209a58c8ec66028d63387402919)`	affected	code_commit	—
`[0,5.10.271)`	affected	semver	—
`[0,5.15.222)`	affected	semver	—
`[0,6.1.189)`	affected	semver	—
`[0,6.6.158)`	affected	semver	—
`[0,6.12.111)`	affected	semver	—
`[0,6.18.53)`	affected	semver	—

Linux

100%

Version	Status	Scheme	Platform
`[5.10.271,5.11.0)`	unaffected	semver	—
`[5.15.222,5.16.0)`	unaffected	semver	—
`[6.1.189,6.2.0)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4a754704698017ced0b657c92b468035faad00ed)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,28d65a0a46435d48b96b6943c518095dff1602a1)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,890a9c3bf9dae90dcabded9d8e10c708a13779f7)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c0742f23ec13fb6f5e0cd884323467a6c127d3c2)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,bd8bc95ef2daa3bac56197cffcbf2d4c5ed42216)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,cb77a50d1114c0c9e084176301a8e094d383edfa)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,56e7e64cdd0e7209a58c8ec66028d63387402919)`	affected	code_commit	—
`[0,5.10.271)`	affected	semver	—
`[0,5.15.222)`	affected	semver	—
`[0,6.1.189)`	affected	semver	—
`[0,6.6.158)`	affected	semver	—
`[0,6.12.111)`	affected	semver	—
`[0,6.18.53)`	affected	semver	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[5.10.271,5.11.0)`	unaffected	semver	—
`[5.15.222,5.16.0)`	unaffected	semver	—
`[6.1.189,6.2.0)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/28d65a0a46435d48b96b6943c518095dff1602a1
https://git.kernel.org/stable/c/4a754704698017ced0b657c92b468035faad00ed
https://git.kernel.org/stable/c/56e7e64cdd0e7209a58c8ec66028d63387402919
https://git.kernel.org/stable/c/890a9c3bf9dae90dcabded9d8e10c708a13779f7
https://git.kernel.org/stable/c/bd8bc95ef2daa3bac56197cffcbf2d4c5ed42216
https://git.kernel.org/stable/c/c0742f23ec13fb6f5e0cd884323467a6c127d3c2
https://git.kernel.org/stable/c/cb77a50d1114c0c9e084176301a8e094d383edfa

History

Fri, 23 Oct 2026 15:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Fri, 23 Oct 2026 14:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125 CWE-787

Fri, 23 Oct 2026 12:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size BASE_ERROR_EVENT carries a variable number of message reports, with the count encoded in error_status. The notification parser used that count without checking whether the received payload contained all reported entries. Reject truncated payloads before copying the report array.
Title		firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/28d65a0a46435d48b96b6943c518095dff1602a1 https://git.kernel.org/stable/c/4a754704698017ced0b657c92b468035faad00ed https://git.kernel.org/stable/c/56e7e64cdd0e7209a58c8ec66028d63387402919 https://git.kernel.org/stable/c/890a9c3bf9dae90dcabded9d8e10c708a13779f7 https://git.kernel.org/stable/c/bd8bc95ef2daa3bac56197cffcbf2d4c5ed42216 https://git.kernel.org/stable/c/c0742f23ec13fb6f5e0cd884323467a6c127d3c2 https://git.kernel.org/stable/c/cb77a50d1114c0c9e084176301a8e094d383edfa

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T11:37:52.692Z

Updated: 2026-10-23T11:37:52.692Z

Reserved: 2026-09-25T10:25:14.378Z

Link: CVE-2026-98892

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T12:18:23.090

Modified: 2026-10-23T12:18:23.090

Link: CVE-2026-98892

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-10-23T15:15:14Z

Weaknesses

CWE-125
Out-of-bounds Read
CWE-787
Out-of-bounds Write

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object