CVE-2026-92490

What it actually does

Use-after-free in the SCMI subsystem where failed driver_register() leaves stale pointers to a module's ID table inside the global protocol IDR; subsequent device matching or creation dereferences freed memory.

Why it matters to the business

Kernel instability or potential code execution on Linux systems that load or unload SCMI protocol drivers, increasing crash risk and maintenance overhead in embedded, server, and cloud environments.

How an attack unfolds

An attacker with the ability to trigger repeated load/unload cycles of an SCMI driver causes a registration failure, leaving dangling IDR entries; later protocol requests then dereference the freed table, enabling memory corruption.

How to fix it

Apply the upstream fix that unrequests the full protocol table before returning a registration failure; rebuild and deploy the patched kernel across all affected Linux distributions.

How to confirm the fix worked

Confirm the patch is present by inspecting the arm_scmi.c source for the unrequest loop before the failure return path; boot-test with synthetic driver registration failures and verify no stale IDR entries remain.

Typical attack path

1. Trigger repeated scmi_driver_register attempts that fail at driver_register()
2. Unload the module so its ID table storage is released while IDR still holds references
3. Cause subsequent SCMI protocol device matching or creation to walk the IDR
4. Dereference the now-freed pointers to corrupt kernel memory or control flow

How to detect it

Review kernel logs for oops or slab-use-after-free reports involving arm_scmi or scmi_protocol structures; correlate with module load/unload events around the time of the crash.

What your security team should do

• Prioritize kernel updates on systems that use SCMI firmware interfaces
• Monitor for any future CVEs in the same arm_scmi registration path
• Restrict unprivileged module loading where feasible to reduce attack surface