CVE-2026-98362: clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate
clk: scpi: bound-check DVFS index in scpidvfsrecalcrate
Affected Software
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems using the Linux kernel SCPI clock driver and relying on SCP firmware for DVFS index values are exposed. Exploitation depends on the SCP firmware returning a stale or otherwise out-of-range index.
What does an attacker or fault condition need to trigger the problem?
The driver must receive a non-negative DVFS index that is greater than or equal to the number of operating points. The described source is buggy or stale SCP firmware output; the provided data does not identify a separate unprivileged trigger.
What happens if an invalid high index is returned?
The vulnerable driver can read past the info->opps array, potentially producing a KASAN out-of-bounds report or supplying an incorrect clock frequency to consumers. The fix treats indexes at or above the operating-point count as invalid and returns 0.
How can I determine whether the issue is occurring?
Look for KASAN out-of-bounds reports involving SCPI DVFS clock-rate recalculation, or investigate unexpected clock rates on systems using the SCPI clock driver. A stale or invalid DVFS index returned by SCP firmware is the relevant condition.