CVE-2022-48655: firmware: arm_scmi: Harden accesses to the reset domains
Vulnerability summary
CVE-2022-48655 is a high (CVSS 8.1) vulnerability in debian debian_linux. EPSS estimates a 0.74% chance of exploitation in the next 30 days, higher than 54.7% of scored vulnerabilities.
Severe, CVSS 8.1 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 11 · Related 9Timeline
- 28-04-2024PublishedVulnerability first disclosed.
- 11-05-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Harden accesses to the reset domains Accessing reset domains descriptors by the index upon the SCMI drivers requests through the SCMI reset operations interface can potentially lead to out-of-bound violations if the SCMI driver misbehave. Add an internal consistency check before any such domains descriptors accesses.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
0.74%
Chance of exploitation in the next 30 days
Percentile
55%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.74% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.
- CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu98 products
- linux< 5.4.0-190.210 | < 5.15.0-57.63
- linux-allwinner-5.19All versions (No fix recorded)
- linux-aws< 5.4.0-1129.139 | < 5.15.0-1027.31
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Debian2 products
- linux< 6.0.2-1
- debian_linuxEOL10.0
Linux2 products
- linux≥ 95a15d80aa0de938299acfcbc6aa6f2b16f5d7e5, < 7184491fc515f391afba23d0e9b690caaea72daf | ≥ 95a15d80aa0de938299acfcbc6aa6f2b16f5d7e5, < f2277d9e2a0d092c13bae7ee82d75432bb8b5108 | ≥ 95a15d80aa0de938299acfcbc6aa6f2b16f5d7e5, < 1f08a1b26cfc53b7715abc46857c6023bb1b87de | ≥ 95a15d80aa0de938299acfcbc6aa6f2b16f5d7e5, < 8e65edf0d37698f7a6cb174608d3ec7976baf49e | ≥ 95a15d80aa0de938299acfcbc6aa6f2b16f5d7e5, < e9076ffbcaed5da6c182b144ef9f6e24554af268 | 5.4
- linux_kernel≥ 5.4, < 5.4.277 | ≥ 5.5, < 5.10.218 | ≥ 5.11, < 5.15.71 | > 5.16, < 5.19.12 | 6.0:rc1 | 6.0:rc2 | 6.0:rc3 | 6.0:rc4 | 6.0:rc5 | 6.0:rc6
3 vendors · 102 products
References
15 links
- security.netapp.com/advisory/ntap-20240912-0008/Third Party Advisory