In the Linux kernel, the following vulnerability has been resolved:

clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate

dvfs_get_idx() may return an out-of-range index if the SCP firmware is buggy or returns a stale value. Only negative indexes were rejected, so a large index walked past info->opps and could treat garbage as a clock rate (KASAN OOB / wrong frequency to consumers). The missing upper bound dates back to the original SCPI clock driver.

Treat indexes >= opp count as invalid and return 0, same as idx < 0.

In the Linux kernel, the following vulnerability has been resolved:

clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate

dvfs_get_idx() may return an out-of-range index if the SCP firmware is buggy or returns a stale value. Only negative indexes were rejected, so a large index walked past info->opps and could treat garbage as a clock rate (KASAN OOB / wrong frequency to consumers). The missing upper bound dates back to the original SCPI clock driver.

Treat indexes >= opp count as invalid and return 0, same as idx < 0.