Intel

CVE-2026-98363

Sicherheitsluecke -- CVE-2026-98363

criticalEPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS scpi_dvfs_get_info() already rejected a zero opp_count, but still trusted any larger value from the SCP firmware. The shared-memory reply only holds MAX_DVFS_OPPS entries in buf.opps[]; a bigger count over-reads that array and then sizes the allocated OPP table incorrectly (garbage OPPs / OOB). The missing upper bound dates back to the original SCPI DVFS support. Reject zero and out-of-range counts in one check and return -EINVAL.

Source: BSI CSAFBSI WID PortalMicrosoft Security Update Guidecvelistv5NVD (NIST)

Metrics

XIEM Effective CVSS
9.8
Source: cna-v3
EPSS percentile
6.1 %
Low — this CVE sits in the lower 10% of all CVEs scored today.
KEV status
—
Show all metrics
Severity
critical
Priority score
79.29
Exploit maturity
no public PoC known
CVSS v3
9.8
EPSS score
0.2 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-10-06 08:46 UTC

References & sources

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. New CVE Received2026-10-06 09:18 UTC· 416baaa9-dc9f-4396-8d5f-8c081fb06d67
    • Description: In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS scpi_dvfs_get_info() already rejected a zero opp_count, but still trusted any larger value from the SCP firmware. The shared-memory reply only holds MAX_DVFS_OPPS entries in buf.opps[]; a bigger count over-reads that array and then sizes the allocated OPP table incorrectly (garbage OPPs / OOB). The missing upper bound dates back to the original SCPI DVFS support. Reject zero and out-of-range counts in one check and return -EINVAL.
    • Affected: New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/98xxx/CVE-2026-98363.json">CVE-2026-98363</a>
    • Reference: https://git.kernel.org/stable/c/0130f9ad3974a5b2ad0fa03d0b300a9fb83ed901
    • Reference: https://git.kernel.org/stable/c/1aadbef648e92ca642125f188f99b0a26628e3ba