The vulnerability stems from the function scmi_power_name_get() in the Linux kernel’s ARM SCMI firmware driver, which fails to validate the domain number supplied by an external caller. This omission allows the function to read memory outside the bounds of the domain array. An attacker who can influence the domain number argument could trigger this out-of-bounds read, potentially causing a kernel fault or exposing kernel memory contents. The primary consequence is disruption of system stability, which may manifest as a crash or reboot. This type of flaw is a classic buffer overread that could lead to denial of service, and in some contexts to information disclosure. In the derived fix the function now returns "unknown" for invalid domains, preventing the erroneous memory access.

The affected products are all Linux kernel builds that include the ARM SCMI firmware driver, namely any distribution kernel that ships the linux_kernel source. The vulnerability applies to all kernel versions that had the flaw prior to the commit that added bounds checking. No specific vendor or product versions are listed beyond the generic "Linux" header in the CNA data. Users running older kernels that have not yet been updated to include the fix are impacted.

The vulnerability’s risk is compounded by the lack of input validation which is often straightforward to exploit in kernel code. Because no EPSS data or KEV listing exists, the absolute likelihood of exploitation cannot be precisely quantified. Nonetheless, the possibility of triggering a kernel fault is high enough to advise immediate mitigation.