Executive brief
The Linux kernel's ARM SCMI (System Control and Management Interface) firmware subsystem contains a device management bug in how it tears down transport device connections. When malformed firmware provides duplicate protocol channel configurations, the kernel could incorrectly reuse or destroy an existing transport device, leading to memory corruption or system instability. This affects systems using ARM SCMI for low-level hardware management.
Technical details
The vulnerability is a logic error in the SCMI bus device matching and teardown path. SCMI transport devices are intentionally excluded from normal protocol driver binding, but the device destruction code used the same matching logic, causing it to fail to find transport devices during channel teardown. Additionally, when duplicate protocol channel nodes appear in malformed firmware, the code could reuse an existing transport device and then destroy it during IDR insertion failure, leading to use-after-free. The fix splits the matching logic into two paths: one that skips transport devices for driver binding and another that explicitly finds them for teardown. It also adds duplicate protocol channel rejection before device creation. The vulnerability requires local access or is triggered by processing untrusted firmware device trees. A patch is available in stable kernel trees.
Affected products
- Linux Linux Kernel multiple versions prior to patch a14dd8fe0a95db638c550ed984cfe2a7428c783d
Timeline
- 2026-09-17: disclosed: CVE-2026-93080 published
- 2026-07-14: patched: Upstream fix committed (a14dd8fe0a95db638c550ed984cfe2a7428c783d)