CVE-2026-80649

HighCVSS 7.8/10Last modified Aug 29, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_scmi: Fix OOB in scmi_power_name_get()

scmi_power_name_get() does not validate the domain number passed by the external caller, which may lead to an out-of-bounds access.

Fix this by returning "unknown" for invalid domains, like scmi_reset_name_get() does.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Aug 28, 2026
Last modified
Aug 29, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-80659.1An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticatCVE-2026-80650In the Linux kernel, the following vulnerability has been resolved: media: atomisp: gc2235: fix UAF and memory leak gc2235_probe() handlesCVE-2026-80651In the Linux kernel, the following vulnerability has been resolved: crypto: ccp/sev-dev-tsm - bail out early when pdev->bus is NULL dsm_crCVE-2026-80652In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths WCVE-2026-806538.4In the Linux kernel, the following vulnerability has been resolved: scsi: hisi_sas: Add slave_destroy interface for v3 hw WARNING is triggCVE-2026-80654In the Linux kernel, the following vulnerability has been resolved: soc: xilinx: Shutdown and free rx mailbox channel A mbox rx channel isCVE-2026-80655In the Linux kernel, the following vulnerability has been resolved: soc: xilinx: Fix race condition in event registration The zynqmp_powerCVE-2026-806567.8In the Linux kernel, the following vulnerability has been resolved: hfsplus: Add a sanity check for btree node size Syzbot reported an uniCVE-2026-80657In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Guard management mailbox channel cleanup against NULL poCVE-2026-80658In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: dw_dp: Fix null-ptr-deref in dw_dp_remove() Attempting tCVE-2026-80659In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: defer reset until cmd_mutex is unlocked vub300_cmndwork_tCVE-2026-80669.1A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated
CVE-2026-80649: High severity, CVSS 7.8 | Vulnix