The vulnerability occurs in the ARM SCMI firmware handler within the Linux kernel. When a SENSOR_UPDATE notification is received, the handler derives the expected number of sensor readings from a preceding sensor description but does not verify that the payload actually contains that many entries before parsing them. This omission allows a malicious or malformed packet to cause the kernel to read beyond the end of the supplied payload, resulting in an out‑of‑bounds read. The leaked data consists of kernel memory contents, leading to potential information disclosure. The flaw corresponds to CWE‑125, which denotes a buffer over-read.

Any Linux kernel that implements the ARM SCMI firmware handler without the fix is vulnerable. The generic CPE string and the absence of a specific version range mean that every unpatched kernel release that contains this component could be impacted, regardless of distribution or configuration. All builds that integrate the SCMI driver without the applied patch are therefore considered at risk.

The CVSS score of 4.4 indicates a moderate severity, while the EPSS score of less than 1 % implies a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, which suggests no publicly known exploitation. An attacker would typically need the ability to send crafted SENSOR_UPDATE packets over the SCMI bus, implying physical proximity or privileged control of the device. Given these constraints, the risk to exposed systems is moderate but the likelihood of an attack remains low; however, the potential to leak kernel memory warrants prompt mitigation.