Executive brief
The ARM SCMI (System Control and Management Interface) firmware driver in Linux handles power and system management on ARM-based devices. A flaw in driver initialization leaves dangling pointers in a global registry when driver registration fails, allowing later operations to dereference freed memory and potentially crash the system or execute arbitrary code.
Technical details
The vulnerability is a use-after-free in the ARM SCMI driver registration path (scmi_driver_register() in drivers/firmware/arm_scmi/bus.c). Before registering the driver with the kernel driver framework, the function requests protocol devices and stores them in a global IDR (ID Radix tree) with pointers to the module's ID table. If driver_register() fails, these requests remain in the global registry with stale pointers to the failed module's deallocated ID table. Subsequently, SCMI device creation or request matching operations can dereference these freed pointers. The fix ensures that scmi_protocol_table_unregister() is called to clean up the protocol table before returning on registration failure. No network exposure; requires kernel module load/unload scenarios.
Affected products
- Linux Linux Kernel Multiple stable versions (linux-5.x, linux-6.x, linux-7.x affected)
Timeline
- 2026-09-17: disclosed: Published on NVD
- 2026-07-22: patched: Upstream commit 9f7cd6a62aa754ed6b48cbd5d50de40add1bcc86 by Sudeep Holla
- 2026-09-14: other: Integrated into stable kernel trees by Greg Kroah-Hartman