The Linux kernel SCM driver for SCPI clocks performs a conversion of a dynamic voltage and frequency scaling (DVFS) index supplied by the SCP firmware without validating the upper bound of the index. If the firmware returns a value greater than or equal to the number of available performance states, the driver reads past the end of the frequency table, triggering a KASAN out‑of‑bounds error and may present a corrupted clock rate to consumers. The consequence is that userspace or kernel components relying on that clock can experience timing instability or incorrect behavior. The weakness involved is a buffer over‑read (CWE‑125). Based on the description, it is inferred that the flaw can lead to misconfigured clock frequencies rather than direct memory corruption or privilege escalation.

This vulnerability exists in the Linux kernel's SCPI clock driver, identified by the cpe:2.3:o:linux:linux_kernel:*. The patch is applied to all future kernel releases after the stated commit IDs. Exact kernel releases that lack the patch are not enumerated in the data, so all builds prior to the patch date are potentially vulnerable.

The CVSS score of 7.0 indicates a high severity vulnerability, while the EPSS score of less than 1% suggests a very low probability of exploitation. The flaw is not listed in CISA’s KEV catalog. The likely attack vector is limited to systems where malicious or stale SCP firmware can be injected or compromised, as the driver relies on firmware data for the index. No documented remote exploitation path exists. Therefore, the risk is moderate to high in environments with untrusted firmware, but the chance of exploitation remains low.