Vulnerability feed

Executive summary

The advisory covers a fix in the Linux kernel's ARM System Control and Management Interface (SCMI) sensor driver, where sensor update notifications were not checked for payload size before being parsed. The advisory does not state how severe the issue is, and it does not describe a specific fix recommendation beyond the patch itself.

Technical summary

The flaw is an input validation problem: the SCMI sensor parser read a variable-length array of sensor readings from a SENSOR_UPDATE notification without first confirming the received payload was long enough to contain them. The fix adds length checks that reject truncated update notifications before the array is read. The advisory does not state the attack vector, preconditions, CVSS score, or exploitation status. It does not list affected or fixed version ranges, and it gives no workaround. Detection guidance is not stated beyond the patch diff.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/1bbe431fc59704d…0647516f6f94ddd82564

Score

No CVSS score published.

Affects

LinuxARMLinuxLinux kernelARM SCMI

Executive summary

This advisory concerns a fix in the Linux kernel's driver for the Arm GICv5 interrupt controller. The flaw could let a long-running interrupt handler or a guest virtual machine block other incoming interrupts, which could cause a denial of service. The advisory does not state a severity score, and the fix is a change to move the priority drop earlier in interrupt handling.

Technical summary

The weakness is an interrupt handling flaw in the GICv5 driver (irq-gic-v5.c) where the priority drop (CDEOI) was performed only during deactivation in irq_eoi(), so interrupts of equal or lower priority could not be signalled while a handler ran. The advisory describes a denial of service effect, for example when a physical interrupt is injected into a guest VM in software, and the attack vector and preconditions beyond this are not stated. The fix moves the CDEOI priority drop to occur immediately after acknowledging an interrupt in gicv5_handle_irq() and removes the earlier CDEOI calls. Affected and fixed kernel version numbers are not stated in the advisory text, and no workaround is stated. No detection guidance or exploitation status is stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/abf60331ebe9a9a…72aac7699c2907ab9307

Score

No CVSS score published.

Affects

LinuxARMLinuxLinux kernelARM GICv5