scpi_dvfs_get_info() in the Linux kernel’s ARM SCPI driver does not enforce an upper bound on the opp_count value received from firmware. While a zero value is rejected, larger counts are accepted, causing the driver to read beyond the allocated buffer. This out‑of‑bounds read can lead to incorrect allocation of the OPP table or corruption of kernel memory, potentially enabling privilege escalation or a denial‑of‑service condition. The weakness is a missing bounds check on a firmware‑provided parameter.

The flaw affects the ARM SCPI firmware interface in the Linux kernel. Any system running a kernel that implements arm_scpi and that accepts SCPI DVFS requests without the upper‑bound guard is vulnerable. This includes ARM‑based devices that rely on the kernel firmware framework for power management. The specific kernel release that introduced the fix is not listed, so all kernels prior to patch may be impacted.

Because the driver processes data sent from external firmware, an attacker who can influence or spoof the firmware response could trigger the out‑of‑bounds read. The exploit would likely require local or firmware‑level access rather than a traditional network attack. The CVSS score of 7.0 indicates medium severity, while the EPSS score is < 1%, showing a very low exploitation probability. KEV is not listed. This suggests that the risk remains moderate until a proof‑of‑concept demonstrates feasibility.