CVE-2026-80649 Overview
CVE-2026-80649 is an out-of-bounds access vulnerability in the Linux kernel's ARM System Control and Management Interface (SCMI) firmware driver. The scmi_power_name_get() function does not validate the domain number passed by external callers, allowing reads beyond the intended array bounds. A local, low-privileged attacker can trigger the flaw by supplying a crafted domain identifier to the SCMI power protocol interface. Successful exploitation can lead to memory disclosure, kernel instability, or corruption of adjacent kernel state. The upstream fix returns the string "unknown" for invalid domains, matching the defensive pattern already implemented in scmi_reset_name_get().
Critical Impact
A local attacker with low privileges can trigger an out-of-bounds read in the SCMI power domain handler, potentially disclosing kernel memory or causing denial of service.
Affected Products
- Linux kernel builds shipping the firmware/arm_scmi driver prior to the upstream fix
- ARM-based systems relying on SCMI firmware for power domain management
- Downstream distributions and vendor kernels that have not yet backported the referenced stable commits
Discovery Timeline
- 2026-08-28 - CVE-2026-80649 published to NVD
- 2026-08-29 - Last updated in NVD database
Technical Details for CVE-2026-80649
Vulnerability Analysis
The defect resides in scmi_power_name_get() within the firmware/arm_scmi subsystem. The function receives a domain index from an external caller and uses it to look up a power domain name without first bounds-checking the value against the number of registered domains. When the caller supplies an index outside the valid range, the function reads memory beyond the end of the internal domain array.
The attack surface is local because SCMI protocol handlers are invoked by kernel components and userspace interfaces that require some level of access to trigger power domain queries. Impacts include kernel memory disclosure, corruption of returned name pointers, and possible follow-on stability issues in code that consumes the invalid result.
Root Cause
The function trusted an externally supplied domain identifier as an array index. Similar SCMI helpers such as scmi_reset_name_get() already returned a safe default ("unknown") for invalid identifiers, but the power domain variant lacked that guard. The upstream patch introduces the same validation and safe fallback behavior, closing the boundary condition.
Attack Vector
Exploitation requires local access with low privileges. An attacker interacts with kernel interfaces that reach scmi_power_name_get() and passes a domain number outside the valid range. The out-of-bounds read then occurs inside kernel context, exposing adjacent memory or destabilizing the driver.
No public proof-of-concept, exploit code, or in-the-wild activity is referenced in the enriched data. Technical details for the fix are available in the upstream stable commits, including Linux Kernel Commit 01613f5 and Linux Kernel Commit ca945974.
Detection Methods for CVE-2026-80649
Indicators of Compromise
- Kernel log entries referencing SCMI power protocol errors or unexpected "unknown" domain names after invalid queries
- KASAN or slab out-of-bounds read reports naming scmi_power_name_get in the call stack
- Unexpected crashes, warnings, or oopses originating in the drivers/firmware/arm_scmi/ subsystem
Detection Strategies
- Monitor kernel ring buffer (dmesg) and journald streams for SCMI-related warnings, KASAN traces, or oops events referencing the power protocol.
- Compare running kernel versions and package build IDs against the fixed commits listed in the kernel.org stable tree to identify unpatched hosts.
- Alert on unprivileged processes that repeatedly enumerate SCMI or power domain sysfs entries in short intervals.
Monitoring Recommendations
- Centralize kernel logs from ARM-based Linux fleets and index them for SCMI and KASAN keywords.
- Track patch state of every ARM Linux host through configuration management so that missing backports of CVE-2026-80649 are visible.
- Correlate local privilege escalation attempts with kernel-driver crashes to surface probing behavior against firmware interfaces.
How to Mitigate CVE-2026-80649
Immediate Actions Required
- Inventory ARM-based Linux systems that load the arm_scmi firmware driver and rank them by exposure to untrusted local users.
- Apply the vendor kernel update that incorporates the upstream fix as soon as it is available for your distribution.
- Restrict local shell and container access on affected hosts until patched builds are deployed.
Patch Information
The upstream fix validates the domain argument and returns "unknown" for invalid identifiers, mirroring scmi_reset_name_get(). The change is available across multiple stable branches through the following commits: 01613f5, 0db2bb3, 11bb771, 11daac2, 30aa348, ca945974, and f9ef3f66. Rebuild or upgrade to a kernel that includes one of these commits.
Workarounds
- Limit local access to affected ARM systems and enforce least-privilege on accounts that can query firmware interfaces.
- Where the SCMI power protocol is not required, avoid loading or exposing the arm_scmi driver in the running configuration.
- Enable kernel hardening options such as KASAN in test builds to surface out-of-bounds accesses during validation before rolling patches to production.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.