---
id: CVE-2026-98893
title: 'firmware: arm_scmi: Validate SENSOR_UPDATE payload size'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  firmware: arm_scmi: Validate SENSOR_UPDATE payload size

  SENSOR_UPDATE carries one or more sensor readings after the fixed
  notification header. The parser derives the e…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    e543d60f966a5f5c92298720c2fd1810f85a6be3
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    87a72e75f7560ea45cd28870194eaa153dd19e75
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    1bbe431fc59704d012660647516f6f94ddd82564
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    c148ff2f5a168e0bc41d801efca6ee35a376cfcb
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    767789a58ae0d65ec3028e5b5b4da82210355d00
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    32bc5496b48174dbca1f187f710955ee4d9527a1
  - Linux < 5.15.222
  - Linux < 6.1.189
  - Linux < 6.6.158
  - Linux < 6.12.111
  - Linux < 6.18.53
  - Linux (all versions)
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T11:37:54.017Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98893'
references:
  - url: 'https://git.kernel.org/stable/c/e543d60f966a5f5c92298720c2fd1810f85a6be3'
  - url: 'https://git.kernel.org/stable/c/87a72e75f7560ea45cd28870194eaa153dd19e75'
  - url: 'https://git.kernel.org/stable/c/1bbe431fc59704d012660647516f6f94ddd82564'
  - url: 'https://git.kernel.org/stable/c/c148ff2f5a168e0bc41d801efca6ee35a376cfcb'
  - url: 'https://git.kernel.org/stable/c/767789a58ae0d65ec3028e5b5b4da82210355d00'
  - url: 'https://git.kernel.org/stable/c/32bc5496b48174dbca1f187f710955ee4d9527a1'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.577Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_scmi: Validate SENSOR_UPDATE payload size

SENSOR_UPDATE carries one or more sensor readings after the fixed
notification header. The parser derives the expected reading count
from the sensor description, but it did not verify that the received
payload contains those entries before parsing them.

Reject truncated update notifications before reading the variable
array.

## Affected

- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < e543d60f966a5f5c92298720c2fd1810f85a6be3`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 87a72e75f7560ea45cd28870194eaa153dd19e75`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 1bbe431fc59704d012660647516f6f94ddd82564`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < c148ff2f5a168e0bc41d801efca6ee35a376cfcb`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 767789a58ae0d65ec3028e5b5b4da82210355d00`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 32bc5496b48174dbca1f187f710955ee4d9527a1`
- `Linux < 5.15.222`
- `Linux < 6.1.189`
- `Linux < 6.6.158`
- `Linux < 6.12.111`
- `Linux < 6.18.53`
- `Linux (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.