Executive brief
The Linux kernel's ARM System Control and Management Interface (SCMI) firmware driver has a resource-management flaw in its protocol device binding logic. When device binding fails or device links cannot be created, the driver failed to clean up acquired handles, causing resource leaks and potential use-after-free scenarios. This could lead to system instability or denial of service in systems using SCMI for firmware communications.
Technical details
The vulnerability is a resource leak and improper error handling in the SCMI bus notifier (firmware/arm_scmi/driver.c). When BUS_NOTIFY_BIND_DRIVER fires, the notifier acquires an SCMI handle via scmi_handle_get(). If device_link_add() fails after the handle is acquired, or if the protocol driver probe later fails with -EPROBE_DEFER, the driver core emits BUS_NOTIFY_DRIVER_NOT_BOUND instead of BUS_NOTIFY_UNBOUND_DRIVER. The original code only released handles on BUS_NOTIFY_UNBOUND_DRIVER, causing failed probes to leak reference counts and leave dangling handle pointers. The fix introduces a scmi_clear_handle() function that properly releases handles on both bind failures and unbind events, ensuring symmetric acquire/release patterns and preventing concurrent use-after-free if a parent unbinds while a child still holds a handle.
Affected products
- Linux Linux kernel multiple versions prior to fix commit e3a5c30d233ca5d3e799a80da806554c703bda13
Timeline
- 2026-09-17: disclosed
- 2026-07-14: patched