CVE-2026-93080firmware: arm_scmi: Fix transport device teardown lookup
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Fix transport device teardown lookup SCMI transport devices are deliberately excluded from normal SCMI bus matching so protocol drivers cannot bind to the internal transport children. However, scmi_device_destroy() uses the same protocol/name lookup to find devices that must be unregistered during channel teardown. Split the match helper so driver matching still skips transport devices, while explicit child lookup can find them for teardown. Use a shared transport-device name prefix macro for both matching and name generation. Since transport-device names are derived from direction and protocol ID, reject duplicate protocol channel setup before creating or finding a transport device. This prevents malformed firmware with duplicate protocol child nodes from reusing an existing transport device and then destroying it when the duplicate IDR insertion fails.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 9593804c44c24545e1b0496786dcb765d7b0e193 before c656427440ea627166394d00c4b72147d5d79c60; 9593804c44c24545e1b0496786dcb765d7b0e193 builds before 4635953b4c1af477e166073521a77de6279f6929; from 9593804c44c24545e1b0496786dcb765d7b0e193 before a14dd8fe0a95db638c550ed984cfe2a7428c783d | CNA record |
References
- https://git.kernel.org/stable/c/c656427440ea627166394d00c4b72147d5d79c60
- https://git.kernel.org/stable/c/4635953b4c1af477e166073521a77de6279f6929
- https://git.kernel.org/stable/c/a14dd8fe0a95db638c550ed984cfe2a7428c783d
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.