Executive brief
The Linux kernel's ARM System Control and Management Interface (SCMI) firmware driver failed to properly validate protocol IDs read from device tree configuration files. A malformed configuration could cause out-of-range protocol values to be processed, potentially allowing an attacker with the ability to modify device tree configuration to trigger unexpected behavior or protocol aliasing in the system management interface.
Technical details
The vulnerability exists in the arm_scmi driver's device tree parsing logic (drivers/firmware/arm_scmi/driver.c). The code reads protocol ID values from the device tree "reg" property and checks whether they fit within MSG_PROTOCOL_ID_MASK, but previously only logged an error and continued processing the invalid value instead of rejecting it. Out-of-range 32-bit values could be truncated when passed to functions expecting u8 protocol IDs, or used as distinct IDR keys while aliasing the same SCMI protocol identity. The fix adds explicit rejection (continue statement) to skip DT protocol nodes that do not fit the valid protocol ID field before channel setup or protocol device creation. This is a local/configuration-based input validation issue that requires an attacker to control or modify the device tree.
Affected products
- Linux Linux kernel multiple kernel versions including 4.x, 5.x, 6.x, and 7.x series
Timeline
- 2026-09-17: disclosed: CVE-2026-93085 published
- 2026-07-14: patched: Upstream patch commit 59407ccb52130f2c81f4b3cbe4f14114afceb54f authored
- 2026-09-14: patched: Stable kernel backports committed