CVE-2026-80649firmware: arm_scmi: Fix OOB in scmi_power_name_get()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Fix OOB in scmi_power_name_get() scmi_power_name_get() does not validate the domain number passed by the external caller, which may lead to an out-of-bounds access. Fix this by returning "unknown" for invalid domains, like scmi_reset_name_get() does.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 29, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 76a6550990e296a7acbb4d33201c9740be912a8c before 01613f5e4ff6c080260615392338e92e261d109b; from 76a6550990e296a7acbb4d33201c9740be912a8c before ca94597440fa546e56293abe9d0af6c73535d44e; 76a6550990e296a7acbb4d33201c9740be912a8c builds before 30aa348494531adfb043b2e883afc0439e5fcdca; 76a6550990e296a7acbb4d33201c9740be912a8c builds before 0db2bb3c948ef8b7364768554d6ab5e1544dc441; 76a6550990e296a7acbb4d33201c9740be912a8c builds before 11daac2817dca75e3eabb2050bc620c29e686fcd; 76a6550990e296a7acbb4d33201c9740be912a8c builds before 11bb771f3c55b4cef3879e69da4ddecd6085569c; from 76a6550990e296a7acbb4d33201c9740be912a8c before f9ef3f66f4b18078e464b7606f9497e4dbeb9905 | CNA record |
References
- https://git.kernel.org/stable/c/01613f5e4ff6c080260615392338e92e261d109b
- https://git.kernel.org/stable/c/ca94597440fa546e56293abe9d0af6c73535d44e
- https://git.kernel.org/stable/c/30aa348494531adfb043b2e883afc0439e5fcdca
- https://git.kernel.org/stable/c/0db2bb3c948ef8b7364768554d6ab5e1544dc441
- https://git.kernel.org/stable/c/11daac2817dca75e3eabb2050bc620c29e686fcd
- https://git.kernel.org/stable/c/11bb771f3c55b4cef3879e69da4ddecd6085569c
- https://git.kernel.org/stable/c/f9ef3f66f4b18078e464b7606f9497e4dbeb9905
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.