Executive brief
A resource management bug in the Linux kernel's ARM SCMI (System Control and Management Interface) firmware driver can leave mailbox channels allocated and unavailable for reuse if a secondary channel setup fails. This affects systems that rely on ARM SCMI for firmware communication and could cause repeated device probe failures or system initialization issues on hardware using this interface.
Technical details
The vulnerability is a resource leak in the mailbox_chan_setup() function within the ARM SCMI transport driver. When requesting a P2A (Platform-to-Agent) receiver mailbox channel after successfully acquiring the primary P2A channel, if the secondary request fails, the function returns without unwinding the successfully allocated primary channel. This leaves the primary channel marked as busy, preventing subsequent probe attempts from acquiring it. The fix involves properly unwinding the allocated resources by jumping to an error handler (goto err_free_chan) instead of returning directly, ensuring the primary channel is released on failure. The bug was introduced in commit fa8b28ba22d9 and affects multiple Linux kernel versions across the stable tree.
Affected products
- Linux Linux kernel multiple versions prior to fix commit f3e3773c4e5e96549d7540d8ddeb4fcd534f6f1d
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched: fix commit f3e3773c4e5e96549d7540d8ddeb4fcd534f6f1d merged to stable