CVE-2026-98362
Last modified
CVE-2026-98362 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate dvfs_get_idx() may return an out-of-range index if the SCP firmware is buggy or returns a stale value. Only negative indexes were rejected, so a large index walked past info->opps and could treat garbage as a clock rate (KASAN OOB / wrong frequency to consumers).
Description
In the Linux kernel, the following vulnerability has been resolved: clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate dvfs_get_idx() may return an out-of-range index if the SCP firmware is buggy or returns a stale value. Only negative indexes were rejected, so a large index walked past info->opps and could treat garbage as a clock rate (KASAN OOB / wrong frequency to consumers). The missing upper bound dates back to the original SCPI clock driver. Treat indexes >= opp count as invalid and return 0, same as idx < 0.
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | >= cd52c2a4b5c43631e429d06dce12e08b0cab477f, < 6e3b55823da8ef0d99621efb422cc29f50d7f280; >= cd52c2a4b5c43631e429d06dce12e08b0cab477f, < 7204095917aeaac89db7377c29a457351a19b076; >= cd52c2a4b5c43631e429d06dce12e08b0cab477f, < 0f89e2ac0e945da2ce798f6a61aebf9d291c2e0a; >= cd52c2a4b5c43631e429d06dce12e08b0cab477f, < 56b7a9d89c67932bf11b71e3b6d17941fc24a393; >= cd52c2a4b5c43631e429d06dce12e08b0cab477f, < a82b274697d0876b478594ca78ad1e6cb062467b; >= cd52c2a4b5c43631e429d06dce12e08b0cab477f, < e1188332a9110cf3635fe286481ee38305b3c2b6; >= cd52c2a4b5c43631e429d06dce12e08b0cab477f, < 108c46e8dacc4a0e472a74f98171115d49cbc079; >= cd52c2a4b5c43631e429d06dce12e08b0cab477f, < 70f4b78d560e592cbf3325b162424737d032fc1d |
| Linux | Linux | 4.4 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-98362?
How severe is CVE-2026-98362?
How do I fix CVE-2026-98362?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-98357In the Linux kernel, the following vulnerability has been re…8.1
- CVE-2026-98358In the Linux kernel, the following vulnerability has been re…
- CVE-2026-98359In the Linux kernel, the following vulnerability has been re…7
- CVE-2026-9836IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 …7.5
- CVE-2026-98360In the Linux kernel, the following vulnerability has been re…7
- CVE-2026-98361In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-98363In the Linux kernel, the following vulnerability has been re…
- CVE-2026-98364In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-98365In the Linux kernel, the following vulnerability has been re…9.8
- CVE-2026-98366In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-98367In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-98368In the Linux kernel, the following vulnerability has been re…7.8
Are you affected by CVE-2026-98362?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST