Executive brief
The Linux kernel's ARM System Control and Management Interface (SCMI) firmware driver had a race condition where interrupt callbacks could fire before the channel state was fully initialized. An attacker or malicious firmware component with access to the system could trigger spurious interrupts during channel setup, leading to a kernel crash or denial of service on systems using ARM SCMI.
Technical details
The vulnerability is a null pointer dereference race condition in the SCMI firmware transport layer. During mailbox or SMC transport channel setup, interrupt callbacks can be enabled by the underlying mailbox controller before the SCMI driver has published its channel state pointers (cinfo->transport_info and cinfo->handle). If a pending or spurious interrupt fires in this window, the RX callback will dereference NULL pointers when accessing transport state or deriving scmi_info from cinfo->handle, causing a kernel fault. The fix involves publishing the transport-private channel state before requesting mailbox channels or IRQs, assigning cinfo->handle before invoking transport setup, and properly unwinding resources on setup failure. No user interaction is required; the race occurs in kernel initialization code with network/firmware access.
Affected products
- Linux Linux kernel 5.0 and later (before patch 0314900dcdde044af0208fed212035dbfaa55843)
Timeline
- 2026-09-17: disclosed
- 2026-07-14: patched: Upstream commit 0314900dcdde044af0208fed212035dbfaa55843