A vulnerability in the Linux kernel arm_scmi firmware driver may allow a local, authenticated attacker to trigger an out-of-bounds access, potentially leading to system instability or privilege escalation.

The scmi_power_name_get function fails to validate input domain numbers, which leads to an out-of-bounds memory access. This flaw requires the attacker to have local access with low privileges to interact with the vulnerable driver.

The vulnerability carries a CVSS score of 7.8, indicating a high risk to system integrity and availability. An attacker capable of exploiting this flaw could potentially cause kernel panics, resulting in service denial, or leverage the memory corruption to escalate privileges beyond their current authorization level.

Immediate Action: Apply the latest kernel patches from your distribution vendor, ensuring the kernel is updated to at least version 5.15.212, 6.1.178, 6.6.145, or 6.12.97.

Proactive Monitoring: Monitor system logs for unexpected kernel oops or segmentation faults that may indicate an exploitation attempt against the arm_scmi interface.

Compensating Controls: Restrict access to system hardware interfaces and drivers to only those users or processes that strictly require them, minimizing the local attack surface.

Public Exploit Available: No

Given the potential for high-impact memory corruption, administrators should prioritize updating the Linux kernel to the provided fixed versions. Because this vulnerability exists at the kernel level, a system reboot will be required to finalize the remediation, and this should be scheduled during the next available maintenance window to ensure security posture.