Executive brief
The Linux kernel's ARM SCMI (Scalable Computing Management Interface) firmware driver failed to properly clean up partial registrations when a protocol registration failed partway through. This could leave dangling pointers to freed driver memory, potentially leading to kernel memory safety issues. The fix ensures all successfully registered entries are rolled back in reverse order before returning an error.
Technical details
The vulnerability exists in the scmi_protocol_table_register() function in drivers/firmware/arm_scmi/bus.c. When registering multiple SCMI device protocol entries from an ID table, if a later entry's registration request fails, the function would return without unregistering the earlier successful entries. Each request retains a pointer to the driver's ID table, so a failed module load could leave a dangling pointer after the module's memory is released. The fix implements proper cleanup by iterating through already-registered entries in reverse order and calling scmi_protocol_device_unrequest() on each before returning the failure code. No special privileges or network access are required; the vulnerability is triggered during normal driver module loading/initialization.
Affected products
- Linux Linux kernel 5.x and 6.x (ARM SCMI firmware driver)
Timeline
- 2026-09-17: disclosed
- 2026-07-22: patched