The Linux kernel’s SCMI firmware interface contains a flaw where the BASE_ERROR_EVENT message may advertise more entries than the payload actually supplies, but the kernel parses the advertised count without checking the actual message length. As a result, the kernel copies beyond the bounds of the supplied buffer, potentially corrupting memory and causing a crash or other incorrect behavior. The primary impact is a denial of service, as the affected system could be forced to reboot or otherwise become unresponsive if the malformed message is processed.

All Linux kernel installations that expose the arm SCMI firmware interface without the patch that validates the BASE_ERROR_EVENT payload size are affected. The exact kernel versions lacking the patch are not listed, but any kernel prior to the upstream fix is potentially vulnerable, including embedded devices and standard distributions that rely on the SCMI protocol.

The KS due to the lack of EPSS data and absence from the CISA KEV catalog means there is no known active exploitation. The vulnerability does not appear to require special privileges beyond the ability to send an SCMI message to the device; however, such a capability is typically limited to firmware or trusted‑OS components. With available mitigations from the kernel patch, the exploitation window is reduced, but until the patch is applied, the risk is moderate for systems that receive untrusted SCMI traffic.