CVE-2026-80649 in Linux
Summary
by MITRE • 08/28/2026
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_scmi: Fix OOB in scmi_power_name_get()
scmi_power_name_get() does not validate the domain number passed by the external caller, which may lead to an out-of-bounds access.
Fix this by returning "unknown" for invalid domains, like scmi_reset_name_get() does.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/28/2026
The Linux kernel's System Control and Management Interface (SCMI) subsystem provides a standardized protocol for communication between the operating system and firmware components responsible for managing hardware resources such as power states, resets, and performance scaling. Within this framework, the arm_scmi driver serves as the interface that translates OS requests into SCMI protocol messages sent to the firmware. A critical security flaw was identified in the scmi_power_name_get() function within this driver, which is responsible for retrieving human-readable names associated with specific power domains defined by the hardware architecture. This vulnerability stems from a fundamental lack of input validation regarding the domain identifier provided by external callers, allowing an attacker or misconfigured software component to trigger out-of-bounds memory access conditions that can compromise system stability and potentially lead to privilege escalation if exploited in conjunction with other vulnerabilities.
The technical root cause lies in the absence of bounds checking for the power domain index before it is used as an array offset or pointer arithmetic base within the scmi_power_name_get() implementation. In typical SCMI implementations, power domains are enumerated starting from zero up to a maximum count determined by hardware capabilities reported during initialization. When an external caller passes a domain number that exceeds this valid range, the function proceeds to access memory locations beyond the allocated buffer containing power domain names. This out-of-bounds read can result in the disclosure of sensitive kernel memory contents, including pointers or cryptographic keys stored adjacent to the name array, thereby violating confidentiality requirements. Furthermore, depending on how the returned value is subsequently processed by higher-level subsystems, it may lead to undefined behavior such as kernel panics or crashes, impacting availability.
From an operational perspective, this vulnerability affects systems relying on ARM SCMI for power management, which includes a significant portion of modern embedded devices, servers, and mobile platforms utilizing ARM Cortex-A series processors. An attacker with local access who can invoke the affected interface through sysfs entries, debug interfaces, or other kernel APIs exposed to user space could exploit this flaw. While direct remote exploitation is unlikely due to the nature of power management operations typically requiring elevated privileges, the vulnerability represents a significant risk for privilege escalation attacks where an unprivileged user might leverage information leaks to map kernel memory layouts and bypass security mitigations like KASLR. The impact extends beyond mere data leakage; it undermines the integrity of system configuration by allowing incorrect or maliciously crafted domain identifiers to propagate errors through the power management stack, potentially causing erratic behavior in device state transitions.
To mitigate this vulnerability, the fix involves implementing strict validation logic within scmi_power_name_get() similar to that already present in the related scmi_reset_name_get() function. Specifically, the code now checks whether the provided domain number is less than the maximum supported power domains before attempting any array access. If the index falls outside the valid range, the function safely returns a static string indicating "unknown" rather than dereferencing invalid memory addresses. This defensive programming approach ensures that even if an attacker supplies malicious input, the system degrades gracefully without exposing internal state or crashing. System administrators and developers should ensure their kernels are updated to include this patch, which is typically available in recent stable releases of the Linux kernel. Additionally, adopting static analysis tools during development can help identify similar missing bounds checks across other SCMI-related functions to prevent recurrence of such issues.
This vulnerability aligns with CWE-125, Out-of-bounds Read, as it involves accessing memory beyond the intended buffer boundary due to insufficient validation of input parameters. In terms of attack patterns, it relates to MITRE ATT&CK technique T1083, File and Directory Discovery, where an attacker might use out-of-bounds reads to enumerate kernel structures or sensitive data stored in contiguous memory regions. The remediation strategy also reflects best practices for secure coding by ensuring that all external inputs are validated against expected ranges before being used as indices or offsets. Maintaining parity with existing safe implementations like scmi_reset_name_get() demonstrates a consistent application of security controls across the driver, reducing the attack surface and enhancing overall system resilience against memory corruption exploits.