Executive brief
The Linux kernel's ARM System Control and Management Interface (SCMI) driver incorrectly modified an internal data structure (IDR) while iterating over it during channel cleanup. This could cause the iteration logic to become corrupted, leading to kernel instability or potential memory corruption.
Technical details
The vulnerability is a use-after-free / iterator invalidation flaw in the ARM SCMI firmware driver's scmi_cleanup_channels() function. While walking IDR (ID Radix tree) structures via idr_for_each(), the destroy callback invoked scmi_device_destroy() and then called idr_remove() on the current entry—the very IDR being iterated. Since idr_for_each() has not yet advanced its internal iterator when the callback executes, modifying the structure invalidates the iterator state, potentially causing corruption or skipped entries. The fix removes the idr_remove() call from the destroy callback and relies on idr_destroy() to clean up remaining entries after iteration completes. No remote attack vector; requires local kernel execution context.
Affected products
- Linux Linux kernel multiple versions with ARM SCMI driver
Timeline
- 2026-09-17: disclosed
- 2026-07-14: patched: Upstream fix authored by Sudeep Holla