CVE-2026-92490firmware: arm_scmi: Unrequest devices if driver registration fails
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Unrequest devices if driver registration fails scmi_driver_register() requests protocol devices before registering the driver. If driver_register() fails, those requests remain in the global IDR and retain pointers to the module's ID table. Once the failed module load releases that storage, later request matching or SCMI device creation can dereference the stale pointers. Unrequest the complete protocol table before returning the registration failure. At this point table registration succeeded, so every entry is owned by the current registration attempt.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from d3cd7c525fd2ecce3a6c963f314969a54783d211 before 524e57035af2d32498af9dd8fa6fdc92fcc8f80a; from d3cd7c525fd2ecce3a6c963f314969a54783d211 before 06e65e07a1bcb39a1ebc8bb89a981f8e07900497; from d3cd7c525fd2ecce3a6c963f314969a54783d211 before a76b20b1f03099204db29b90e1024fe1c2b2cdd7; from d3cd7c525fd2ecce3a6c963f314969a54783d211 before 4520d4a1db37198756ad23568e36cdf091b6ffff; from d3cd7c525fd2ecce3a6c963f314969a54783d211 before 9f7cd6a62aa754ed6b48cbd5d50de40add1bcc86 | CNA record |
References
- https://git.kernel.org/stable/c/524e57035af2d32498af9dd8fa6fdc92fcc8f80a
- https://git.kernel.org/stable/c/06e65e07a1bcb39a1ebc8bb89a981f8e07900497
- https://git.kernel.org/stable/c/a76b20b1f03099204db29b90e1024fe1c2b2cdd7
- https://git.kernel.org/stable/c/4520d4a1db37198756ad23568e36cdf091b6ffff
- https://git.kernel.org/stable/c/9f7cd6a62aa754ed6b48cbd5d50de40add1bcc86
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.