Executive brief
The Linux kernel's ARM System Control and Management Interface (SCMI) firmware driver contains a vulnerability in the power domain name retrieval function that fails to validate user-supplied domain identifiers. An attacker with local access could trigger an out-of-bounds memory read by specifying an invalid domain number, potentially disclosing sensitive kernel memory or causing a system crash.
Technical details
The vulnerability is a missing input validation flaw in the scmi_power_name_get() function in drivers/firmware/arm_scmi/power.c. The function accepts a domain number parameter from an external caller but does not verify that the domain index is within the valid range before using it to access the power domain information array. An attacker with the ability to call this function with an out-of-bounds domain number can read arbitrary kernel memory locations, leading to information disclosure or denial of service. The fix adds a bounds check that returns "unknown" for invalid domain numbers, mirroring the approach used in the similar scmi_reset_name_get() function. A patch has been available since at least July 2026.
Affected products
- Linux Linux kernel Multiple versions containing the ARM SCMI power protocol support (introduced in kernel with commit 76a6550990e296a7)
Timeline
- 2026-08-28: disclosed: CVE-2026-80649 published
- 2026-05-15: patched: Fix committed upstream by Geert Uytterhoeven
- 2026-07-24: patched: Patch backported to stable kernel branches