Riskcovery

CVE-2026-93086

firmware: arm_scmi: Avoid IDR updates while cleaning channels

State
Published
Severity
Not scored
Published
Sep 17, 2026
Updated
Oct 30, 2026
Reserved
Sep 17, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_scmi: Avoid IDR updates while cleaning channels

scmi_cleanup_channels() walks the TX/RX channel IDRs with idr_for_each() to free transport resources and destroy the dedicated transport devices before calling idr_destroy().

The destroy callback removed each entry from the same IDR being walked. That is not needed for this cleanup path, and it is unsafe because idr_for_each() has not advanced its radix-tree iterator while the callback is running. Removing the current entry from the callback can invalidate the iterator state. The callback also cannot be protected by rcu_read_lock(), because scmi_device_destroy() may sleep.

Leave IDR teardown to the following idr_destroy() call and keep the callback limited to device destruction.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 22f7f35fd71b597a5d916e41d7646be6ee530c86 to before f50698c617350a6e2064dffd6cff3f391e142f55Affected
  • 05a2801d8b90c1b5159618d4bd3a3c65d60f3ff1 to before aed24a3c63920539e9de7fbfe7929a2e7c888cd2Affected
  • 05a2801d8b90c1b5159618d4bd3a3c65d60f3ff1 to before 431c6b872ba7fedcc5a3afb0ec3517db4d95d088Affected
  • 05a2801d8b90c1b5159618d4bd3a3c65d60f3ff1 to before 54e5a4f7d83db4552d963d0785be32d9df680dcdAffected
  • 05a2801d8b90c1b5159618d4bd3a3c65d60f3ff1 to before bab26acebe55e8ad3ab545abda72faa7ca28c477Affected
  • 05a2801d8b90c1b5159618d4bd3a3c65d60f3ff1 to before c38b1e19485aaa820e52cfe162525a8af67563daAffected
LinuxLinux
  • 6.3Affected
  • before 6.3Not affected
  • 6.6.157 through 6.6.*Not affected
  • 6.12.110 through 6.12.*Not affected
  • 6.18.52 through 6.18.*Not affected
  • 7.2.6 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.