HIGH Introduced in 4.17
arm_scmi PowerDomain OOB
CVE-2026-80649
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI5.9MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Fix OOB in scmi_power_name_get() scmi_power_name_get() does not validate the domain number passed by the external caller, which may lead to an out-of-bounds access. Fix this by returning "unknown" for invalid domains, like scmi_reset_name_get() does.
02KernelScan AI Analysis
Risk summary
A missing bounds check in the ARM SCMI power protocol's domain name lookup allows an out-of-bounds read when a caller supplies an invalid domain number. On ARM platforms using SCMI for power management, a local attacker who can influence the domain index can leak limited kernel heap memory or crash the kernel. The impact is limited to ARM systems with the SCMI power protocol enabled.
Vulnerability analysis
The SCMI power protocol's domain name lookup function uses a caller-supplied domain number as a direct array index without checking it against the number of registered power domains. When the index exceeds the array bounds, the function reads memory beyond the allocation, which can either return leaked kernel heap data as a string or trigger a kernel panic by dereferencing unmapped memory. The fix adds a simple bounds check that returns a placeholder string for any domain number outside the valid range, matching the pattern already used in the SCMI reset protocol. This vulnerability is reachable only on ARM platforms that use the SCMI firmware interface for power domain management, and requires a local caller who can influence the domain number passed to the power protocol handler.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 4.17 | 5.15.212 | 01613f5e4ff6 |
| 6.12 | 4.17 | 6.12.97 | 0db2bb3c948e |
| 6.18 | 4.17 | 6.18.40 | 11daac2817dc |
| 7.1 | 4.17 | 7.1.5 | 11bb771f3c55 |
| 6.6 | 4.17 | 6.6.145 | 30aa34849453 |
| mainline | 4.17 | 7.2 | f9ef3f66f4b1 |
| 6.1 | 4.17 | 6.1.178 | ca94597440fa |
| cip/6.1 | 4.17 | 6.1.182-cip59 | ca94597440fa |
| cip/6.1-rt | 4.17 | 6.1.182-cip59-rt31 | ca94597440fa |
| cip/6.12 | 4.17 | 6.12.101-cip29 | 0db2bb3c948e |