Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Linux kernel before 6.6.158.1-1 may set wrong clock rates

published 29 days ago
Summary

The Linux kernel code that controls CPU power management can accept an invalid value from the system controller and use it to set an incorrect clock speed. This could cause devices to run at unexpected speeds, potentially leading to instability. Update the kernel to a version newer than 6.6.158.1-1, or apply the provided patches, to ensure the value is validated.

What to do
  • Update kernel to version 6.6.158.1-1.
Affected software
Ecosystem VendorProductAffected versions
Azure Linux:3 – kernel < 6.6.158.1-1
Fix: upgrade to 6.6.158.1-1
Azure Linux:3 azure kernel <= 6.6.157.1-1
Original advisory text
CVE-2026-98362 affecting package kernel for versions less than 6.6.158.1-1
In the Linux kernel, the following vulnerability has been resolved:

clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate

dvfs_get_idx() may return an out-of-range index if the SCP firmware is
buggy or returns a stale value. Only negative indexes were rejected, so a
large index walked past info->opps and could treat garbage as a clock rate
(KASAN OOB / wrong frequency to consumers). The missing upper bound dates
back to the original SCPI clock driver.

Treat indexes >= opp count as invalid and return 0, same as idx < 0.
References
Timeline
Published6 Oct 2026
Updated2 Nov 2026
First seen7 Oct 2026
Sources
AZL-106020 · OSV
Track software like this
Free during beta