CVE-2026-98893

A flaw was found in the Linux kernel's ARM System Control and Management Interface SCMI sensor driver. The driver fails to verify that the received notification payload size is large enough to contain all expected sensor readings before parsing them. A malicious or compromised firmware platform c...

CVE-2026-98892

A flaw was found in the Linux kernel's ARM System Control and Management Interface SCMI firmware driver. The notification handler fails to properly validate the size of incoming base error event payloads before copying the report array. A compromised or malfunctioning firmware interface can provi...

PT-2026-121863

In the Linux kernel, the following vulnerability has been resolved: firmware: arm scmi: Validate SENSOR UPDATE payload size SENSOR UPDATE carries one or more sensor readings after the fixed notification header. The parser derives the expected reading count from the sensor description, but it did...

PT-2026-121862

In the Linux kernel, the following vulnerability has been resolved: firmware: arm scmi: Validate BASE ERROR EVENT payload size BASE ERROR EVENT carries a variable number of message reports, with the count encoded in error status. The notification parser used that count without checking whether th...

CLSA-2025-1747725447 kernel: Fix of 38 CVEs

ext4: fix OOB read when checking dotdot dir CVE-2025-37785 - wifi: iwlwifi: limit printed string from FW file CVE-2025-21905 - drm/amdgpu: Fix potential out-of-bounds access in 'amdgpudiscoveryregbaseinit' CVE-2024-27042 - dm-crypt: don't modify the data when using authenticated encryption...

CVE-2026-93093

A flaw was found in the Linux kernel's ARM System Control and Management Interface SCMI firmware. During the SCMI channel setup, a race condition can occur where callbacks are enabled before the channel state is fully initialized. If a callback fires in this window, it can lead to a null pointer...

CVE-2026-93085

A flaw was found in the ARM System Control and Management Interface SCMI firmware within the Linux kernel. This vulnerability occurs because the system fails to properly reject out-of-range Device Tree DT protocol identifiers. A local attacker could exploit this by providing a malformed 32-bit DT...

CVE-2026-93080

A flaw was found in the Linux kernel's ARM System Control and Management Interface SCMI firmware. This vulnerability occurs because the scmidevicedestroy function, responsible for tearing down SCMI transport devices, uses an incorrect lookup mechanism. Malformed firmware with duplicate protocol...

CVE-2026-93081

A flaw was found in the Linux kernel's ARM System Control and Management Interface SCMI firmware. This vulnerability occurs due to improper handling of device reference counts during the device destruction process. A concurrent unregister operation can release a device while its pointer is still ...

CVE-2026-92506

A flaw was found in the Linux kernel's ARM System Control and Management Interface SCMI firmware. A race condition during device removal can occur when two SCMI drivers concurrently unregister for the same protocol. This can lead to a double-free vulnerability, where memory is freed twice,...

CVE-2026-92491

A flaw was found in the Linux kernel's ARM System Control and Management Interface SCMI firmware. During the registration of protocol tables, the scmiprotocoltableregister function may fail to properly unregister previous requests if a subsequent entry fails. This can result in a dangling pointer...

CVE-2026-92490

A flaw was found in the Linux kernel's ARM System Control and Management Interface SCMI firmware driver. When a driver fails to register, the system may not properly unregister associated protocol devices, leaving behind invalid references. This can lead to the system attempting to access memory...

Astra Linux – Vulnerability in Linux 5.15, Linux

In the Linux kernel, the following vulnerability has been resolved: Firmware: armscmi: Hardened access to reset domains. Accessing reset domain descriptors via indexes in SCMI driver requests, through the SCMI reset operation interface, may potentially lead to out-of-bound violations if the SCMI...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Firmware: armscmi: Fixed a double-free in the SMC transport cleanup process. When the generic SCMI code destroys a channel, it calls the chanfree callback function, which is defined by each transport. Since multiple protocols may...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Firmware: armscmi: Fixed a double-free operation in the OPTEE transport. Channels can be shared between protocols; avoiding the need to free the same descriptor twice when unloading the stack...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: pmdomain: arm: scmi: Fixed the issue of a memory leak caused by the failure to remove generic power domains when the ofgenpdaddprovideronecell function fails during probing. If the ofgenpdaddprovideronecell function fails during...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Firmware: armscmi: Balances the device reference count when destroying devices. Using devicefindchild to find the appropriate SCMI device to destroy causes an imbalance in the device reference count. This occurs because...

CVE-2026-93090

A flaw was found in the Linux kernel's ARM System Control and Management Interface SCMI firmware. During the setup of SCMI channels, a failure can occur where previously registered resources are not properly released. This oversight can lead to resource exhaustion, potentially causing system...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: The regulator: scmi – a fix was made to the refcount leak in scmiregulatorprobe. The offindnodebyname function returns a node pointer with the refcount incremented; we should use ofnodeput on it after processing. Add the missing...

AZL-101957 CVE-2026-93085 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Reject out of range DT protocol IDs SCMI protocol IDs carried in message headers are limited by MSGPROTOCOLIDMASK. The DT parsing paths noticed protocol IDs outside that range, but only logged an error and then...