CVE-2026-98362

What it actually does

Missing upper bound check on DVFS index returned by dvfs_get_idx() allows out-of-bounds access past the opps array in scpi_dvfs_recalc_rate, causing the driver to interpret arbitrary memory as a clock rate or trigger KASAN-detected OOB read.

Why it matters to the business

Systems using the SCPI clock driver may report or apply incorrect CPU/GPU frequencies, leading to performance degradation, instability, or hardware misconfiguration on affected Linux kernels.

How an attack unfolds

An attacker or compromised SCP firmware supplies an excessively large DVFS index; the kernel performs no upper-bound validation, dereferences beyond the allocated opps table, and either reads garbage or triggers an out-of-bounds condition that can be observed via KASAN or used to influence clock consumers.

How to fix it

Update to a Linux kernel containing the bound-check fix that rejects indexes >= opp count and returns 0; rebuild and deploy the updated kernel image across all affected systems.

How to confirm the fix worked

Confirm the presence of the upper-bound check (index >= opp_count return 0) in scpi_dvfs_recalc_rate; run targeted KASAN-enabled tests that feed large indexes from a mock SCP interface.

Typical attack path

1. Gain ability to influence or replace SCP firmware responses
2. Return a DVFS index >= number of opps entries from dvfs_get_idx()
3. Trigger scpi_dvfs_recalc_rate on the affected clock
4. Observe or abuse the resulting out-of-bounds memory access

How to detect it

Search kernel logs for KASAN reports mentioning scpi_dvfs_recalc_rate or out-of-bounds accesses in the clk-scpi driver; monitor for unexpected clock rate values reported to consumers.

• scpi_dvfs_recalc_rate
• dvfs_get_idx
• KASAN: out-of-bounds in clk-scpi

What your security team should do

• Apply the upstream fix to all kernels using the SCPI clock driver
• Prioritize systems where the SCP firmware may return stale or malformed DVFS data
• Enable KASAN or similar memory-safety instrumentation on test fleets to validate the fix