Junglewise Threat Intelligence

CVE-2026-93080: Linux kernel ARM SCMI transport device teardown logic flaw

CVE-2026-93080 · Severity: info · Published 2026-09-17

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's ARM SCMI (System Control and Management Interface) firmware subsystem contains a device management bug in how it tears down transport device connections. When malformed firmware provides duplicate protocol channel configurations, the kernel could incorrectly reuse or destroy an existing transport device, leading to memory corruption or system instability. This affects systems using ARM SCMI for low-level hardware management.

Technical details

The vulnerability is a logic error in the SCMI bus device matching and teardown path. SCMI transport devices are intentionally excluded from normal protocol driver binding, but the device destruction code used the same matching logic, causing it to fail to find transport devices during channel teardown. Additionally, when duplicate protocol channel nodes appear in malformed firmware, the code could reuse an existing transport device and then destroy it during IDR insertion failure, leading to use-after-free. The fix splits the matching logic into two paths: one that skips transport devices for driver binding and another that explicitly finds them for teardown. It also adds duplicate protocol channel rejection before device creation. The vulnerability requires local access or is triggered by processing untrusted firmware device trees. A patch is available in stable kernel trees.

Affected products

  • Linux Linux Kernel multiple versions prior to patch a14dd8fe0a95db638c550ed984cfe2a7428c783d

Timeline

  • 2026-09-17: disclosed: CVE-2026-93080 published
  • 2026-07-14: patched: Upstream fix committed (a14dd8fe0a95db638c550ed984cfe2a7428c783d)

References

Related threats