In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size BASE_ERROR_EVENT… (CVE-2026-98892)

The Linux kernel's arm_scmi firmware component had a vulnerability where the BASE_ERROR_EVENT notification parser trusted the count of message reports encoded in error_status without verifying that the received payload contained all the entries indicated. This could lead to improper handling of truncated payloads. The vulnerability was resolved by adding validation to reject truncated payloads before copying the report array, preventing potential issues from incomplete data processing.

The vulnerability could allow the kernel to process incomplete or truncated BASE_ERROR_EVENT payloads, which may cause incorrect behavior or instability in the affected firmware interface. No specific exploitation details or impacts such as privilege escalation or denial of service are provided in the source data.

A fix has been applied to the Linux kernel to validate the BASE_ERROR_EVENT payload size and reject truncated payloads. Users should update to the fixed kernel version once available. Patch status is not explicitly confirmed in the provided data; check the official Linux kernel advisories for the exact fixed versions and remediation guidance.