Description

In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Fix OOB in scmi_power_name_get() scmi_power_name_get() does not validate the domain number passed by the external caller, which may lead to an out-of-bounds access. Fix this by returning "unknown" for invalid domains, like scmi_reset_name_get() does.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-28T08:16:49.897Z",
  "pubdate": "2026-08-28T08:16:49.897Z",
  "executiveSummary": "A critical out-of-bounds (OOB) vulnerability exists within the Linux kernel's System Control and Management Interface (SCMI) power management component.\nThe vulnerability resides in the scmi_power_name_get() function, which fails to perform input validation on domain identifiers supplied by external callers.\nThis lack of bounds checking allows an attacker to provide an arbitrary domain index, potentially leading to out-of-bounds memory access.\nThe impact includes kernel memory corruption, potential information disclosure, or system instability, such as a kernel panic (denial of service).\nAffected systems are those running Linux kernel versions utilizing the SCMI framework for power management.\nExploitation requires an attacker to interact with the SCMI subsystem, which typically necessitates elevated privileges or access to interfaces that bridge user-space to kernel-space SCMI drivers.",
  "technicalDetails": "The vulnerability is localized to the scmi_power_name_get() function within the Linux kernel's SCMI driver subsystem. The root cause is a deficiency in input sanitization: the function accepts a domain identifier from an external caller without verifying that the index falls within the valid range of defined power domains.\nIn the SCMI architecture, power domains are typically indexed. When scmi_power_name_get() is invoked, it uses the provided domain identifier to reference an array or a list of power domain structures. Without bounds validation, a crafted or erroneous index that exceeds the allocated array size permits the kernel to read memory outside the intended boundaries.\nThe attack flow begins when an attacker or an improperly behaving driver component triggers a call to scmi_power_name_get() with an out-of-bounds domain index. Because the function does not validate this index against the known count of registered power domains, the kernel executes a memory read operation at an address calculated based on the malicious index.\nThe exploitation method relies on the kernel treating the out-of-bounds memory location as a pointer to, or part of, a power domain structure. If successful, the attacker may influence the data returned to user-space or trigger a memory fault due to accessing non-mapped or restricted memory pages, resulting in an immediate kernel panic.\nThis vulnerability is particularly significant because it reflects a failure to adhere to safe coding practices for array indexing in a kernel-context. By failing to check the input index against established limits, the function exposes the kernel to arbitrary read primitives or system instability. Following the resolution pattern established in scmi_reset_name_get(), the fix involves implementing a check to verify the domain ID. If the ID is invalid, the function should return a safe fallback string like 'unknown' rather than proceeding with an unsafe memory operation.\nThe potential post-exploitation impact includes the leakage of sensitive kernel data or the initiation of a denial-of-service condition, hindering the stability and integrity of the underlying system. The complexity of exploitation depends on the specific memory layout and the accessibility of the SCMI communication path from an attacker-controlled context."
}