CVE-2026-98362

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-98362
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98362.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-98362
Downstream
Published
2026-10-06T08:46:48Z
Modified
2026-10-07T02:47:34Z
Summary
clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate
Details

In the Linux kernel, the following vulnerability has been resolved:

clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate

dvfs_get_idx() may return an out-of-range index if the SCP firmware is buggy or returns a stale value. Only negative indexes were rejected, so a large index walked past info->opps and could treat garbage as a clock rate (KASAN OOB / wrong frequency to consumers). The missing upper bound dates back to the original SCPI clock driver.

Treat indexes >= opp count as invalid and return 0, same as idx < 0.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98362.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
cd52c2a4b5c43631e429d06dce12e08b0cab477f
Fixed
6e3b55823da8ef0d99621efb422cc29f50d7f280
Fixed
7204095917aeaac89db7377c29a457351a19b076
Fixed
0f89e2ac0e945da2ce798f6a61aebf9d291c2e0a
Fixed
56b7a9d89c67932bf11b71e3b6d17941fc24a393
Fixed
a82b274697d0876b478594ca78ad1e6cb062467b
Fixed
e1188332a9110cf3635fe286481ee38305b3c2b6
Fixed
108c46e8dacc4a0e472a74f98171115d49cbc079
Fixed
70f4b78d560e592cbf3325b162424737d032fc1d

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98362.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.4.0
Fixed
5.10.271
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.222
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.189
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.158
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.112
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.54
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.2.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98362.json"