CVE-2026-80649

CVE-2026-80649 is an out-of-bounds access vulnerability in the Linux kernel's ARM System Control and Management Interface (SCMI) firmware driver, in the scmi_power_name_get() function that looks up power-domain names. The function does not validate the domain number supplied by its external caller, so an out-of-range domain ID can be used to index beyond the power-domain name table, accessing memory outside the intended bounds. An attacker with local, low-privileged access (CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N) could trigger the condition, and the assigned score of 7.8 (high) reflects potential high confidentiality, integrity, and availability impact; the upstream fix returns "unknown" for invalid domains, mirroring the existing scmi_reset_name_get() behavior. Affected systems are Linux deployments whose kernels include and use the ARM SCMI power-domain driver — typically ARM64 servers, embedded boards, and devices whose firmware implements SCMI; the advisory specifies no affected or fixed kernel version ranges, so defenders should track the upstream commit and distribution backports. Exploitation status is quiet: no public proof-of-concept, not listed in CISA KEV, and a low EPSS of 0.1% (3rd percentile) for exploitation in the next 30 days.

What to do: Patch via your Linux distribution as soon as it ships the upstream fix, and confirm the commit is included in your running kernel; the advisory gives no fixed version, so rely on your vendor's backport notice. Check whether ARM64 systems in your fleet build the ARM SCMI power domain driver (CONFIG_ARM_SCMI_POWER_DOMAIN) and whether local unprivileged users can reach it; x86 and other non-SCMI systems are out of scope. As an interim mitigation on affected ARM systems, restrict local unprivileged access and avoid loading unused SCMI power-domain support; no emergency action is warranted given the absence of known exploitation.