CVE-2026-98363

What it actually does

Out-of-bounds read from shared-memory buffer and incorrect sizing of the OPP table in scpi_dvfs_get_info() when firmware supplies an opp_count larger than MAX_DVFS_OPPS, resulting in kernel memory corruption or garbage OPP entries.

Why it matters to the business

May trigger kernel crashes, instability, or memory corruption on systems using the arm_scpi DVFS path; successful exploitation requires influence over the SCP firmware and could enable local privilege escalation or denial of service.

How an attack unfolds

An attacker who can supply or tamper with the SCP firmware response returns an opp_count value exceeding the fixed array size; the kernel trusts this value, reads past the end of buf.opps[], and allocates an incorrectly sized OPP table, leading to subsequent memory corruption.

How to fix it

Apply a kernel update that adds an explicit upper-bound check rejecting zero and out-of-range opp_count values in the arm_scpi driver; rebuild and deploy the patched kernel across affected systems.

How to confirm the fix worked

Confirm the presence of the bounds check that returns -EINVAL for any opp_count outside the valid range; inspect kernel logs for correct rejection behavior under synthetic firmware responses.

Typical attack path

1. Gain control or the ability to spoof responses from the SCP firmware
2. Issue a DVFS get-info command that elicits a reply with opp_count > MAX_DVFS_OPPS
3. Kernel invokes scpi_dvfs_get_info() and performs unchecked read and allocation
4. Subsequent DVFS operations dereference corrupted or out-of-bounds OPP data

How to detect it

Search kernel logs and dmesg for arm_scpi or scpi_dvfs_get_info errors, unexpected -EINVAL returns, or oops traces involving OPP table allocation; examine shared-memory buffers for anomalous opp_count values during DVFS initialization.

What your security team should do

• Prioritize kernel updates on all systems exposing the arm_scpi DVFS interface
• Review boot firmware and SCP images for integrity and update where possible
• Add monitoring for arm_scpi-related kernel warnings or allocation anomalies