Executive brief
A race condition in the Linux kernel's ARM SCMI (System Control and Management Interface) firmware driver could allow a notifier callback to access an IDR (ID Radix tree) data structure while it is being destroyed during device removal. This could lead to kernel memory corruption or a crash, affecting system stability on ARM-based platforms using SCMI.
Technical details
The vulnerability is a race condition in the SCMI driver's device removal path. The requested-devices notifier performs lookups in the active_protocols IDR, but during module unload/device removal, the notifier was not unregistered before the IDR was destroyed. This creates a window where a notifier callback could execute concurrently with IDR teardown, causing use-after-free or corruption. The fix reorders the cleanup sequence to unregister the device notifier before calling idr_destroy(), ensuring no callback can race with IDR destruction. The vulnerability affects the ARM SCMI firmware subsystem in the Linux kernel.
Affected products
- Linux Linux kernel affected versions prior to fix commit 66a0bbf30cc14140fe13f63cd594a7c1ee352b75
Timeline
- 2026-09-17: disclosed
- 2026-07-14: patched: Fix committed upstream