CVE-2026-93086firmware: arm_scmi: Avoid IDR updates while cleaning channels
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Avoid IDR updates while cleaning channels scmi_cleanup_channels() walks the TX/RX channel IDRs with idr_for_each() to free transport resources and destroy the dedicated transport devices before calling idr_destroy(). The destroy callback removed each entry from the same IDR being walked. That is not needed for this cleanup path, and it is unsafe because idr_for_each() has not advanced its radix-tree iterator while the callback is running. Removing the current entry from the callback can invalidate the iterator state. The callback also cannot be protected by rcu_read_lock(), because scmi_device_destroy() may sleep. Leave IDR teardown to the following idr_destroy() call and keep the callback limited to device destruction.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 05a2801d8b90c1b5159618d4bd3a3c65d60f3ff1 before aed24a3c63920539e9de7fbfe7929a2e7c888cd2; from 05a2801d8b90c1b5159618d4bd3a3c65d60f3ff1 before 431c6b872ba7fedcc5a3afb0ec3517db4d95d088; from 05a2801d8b90c1b5159618d4bd3a3c65d60f3ff1 before 54e5a4f7d83db4552d963d0785be32d9df680dcd; from 05a2801d8b90c1b5159618d4bd3a3c65d60f3ff1 before bab26acebe55e8ad3ab545abda72faa7ca28c477; from 05a2801d8b90c1b5159618d4bd3a3c65d60f3ff1 before c38b1e19485aaa820e52cfe162525a8af67563da | CNA record |
References
- https://git.kernel.org/stable/c/aed24a3c63920539e9de7fbfe7929a2e7c888cd2
- https://git.kernel.org/stable/c/431c6b872ba7fedcc5a3afb0ec3517db4d95d088
- https://git.kernel.org/stable/c/54e5a4f7d83db4552d963d0785be32d9df680dcd
- https://git.kernel.org/stable/c/bab26acebe55e8ad3ab545abda72faa7ca28c477
- https://git.kernel.org/stable/c/c38b1e19485aaa820e52cfe162525a8af67563da
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.