CVE-2026-80649

What it actually does

Missing input validation on the domain number parameter in scmi_power_name_get() allows an out-of-bounds memory read when an invalid domain identifier is supplied by a caller.

Why it matters to the business

Local attackers may read kernel memory contents or trigger system instability, raising the risk of privilege escalation on Linux hosts that use the SCMI power management interface.

How an attack unfolds

An attacker with local access invokes the SCMI firmware interface with an out-of-range power domain number; the unchecked value causes scmi_power_name_get() to dereference memory outside the intended array, disclosing data or crashing the kernel.

How to fix it

Apply a kernel update that includes the upstream fix returning the string "unknown" for invalid domains in scmi_power_name_get(), matching the behavior already present in scmi_reset_name_get().

How to confirm the fix worked

Confirm the fix by inspecting the arm_scmi driver source for the added domain-range check and "unknown" return path, or verify the running kernel version contains the corresponding commit.

Typical attack path

1. Gain local shell or process execution on the target host
2. Locate the SCMI power domain sysfs or ioctl entry points
3. Supply an invalid domain index to scmi_power_name_get()
4. Observe or weaponize the resulting out-of-bounds read

How to detect it

Search kernel logs and audit trails for arm_scmi warnings, oops reports, or repeated calls to power-domain name functions with out-of-range values; correlate with local process activity around the SCMI subsystem.

What your security team should do

• Prioritize kernel updates on all systems exposing SCMI power domains
• Limit local user access to firmware interfaces where feasible
• Monitor kernel logs for arm_scmi oops or warning messages
• Review EPSS trend and exploit maturity before scheduling changes