Executive brief
The Qualcomm Secure Channel Manager (SCM) is a firmware interface used by Linux systems running on Qualcomm processors to handle security-sensitive operations. A NULL pointer dereference bug in the IRQ handler and during device probe can cause a kernel crash before the SCM is fully initialized, resulting in a denial of service.
Technical details
The vulnerability is a NULL pointer dereference in the Qualcomm SCM firmware driver (drivers/firmware/qcom/qcom_scm.c). The root cause occurs in qcom_scm_probe() where devm_request_threaded_irq() is called before smp_store_release(&__scm, scm) publishes the global __scm pointer. Two execution paths can dereference __scm before initialization: (1) the IRQ handler path that calls qcom_scm_waitq_wakeup() and qcom_scm_get_completion(), and (2) non-atomic SMC calls during probe that trigger qcom_scm_wait_for_wq_completion(). The fix threads the scm structure through function parameters instead of relying on the global __scm pointer, and uses platform_set_drvdata() early in probe with dev_get_drvdata() for runtime access. No authentication or user interaction is required; the bug occurs during kernel initialization. The patch was merged into the mainline kernel and is available.
Affected products
- Linux Linux Kernel All versions with Qualcomm SCM wait-queue support (commit 6bf325992236 and later)
Timeline
- 2026-09-17: disclosed
- 2026-07-30: patched: Commit 966d23c7e68ea32679275a7e3d2383181002c868 merged to mainline
- 2026-07-24: other: Fix authored by Mukesh Ojha