CVE-2026-92491

What it actually does

The flaw leaves a dangling pointer to a driver's ID table in the SCMI protocol registration table after a partial failure during scmi_protocol_table_register(); module unload then frees the backing storage while the pointer remains, enabling a classic use-after-free on subsequent access.

Why it matters to the business

Kernel instability, crashes, or potential memory corruption on Linux systems that use the ARM SCMI firmware interface; may interrupt workloads or create an exploitable condition in environments that dynamically load or unload SCMI drivers.

How an attack unfolds

An attacker arranges for a module load that registers some but not all entries in an SCMI protocol ID table, forces the module to unload (freeing the table), then triggers any code path that dereferences the stale pointer left in the global protocol table.

How to fix it

Apply the upstream fix that performs ordered unregistration of only the successfully registered prefix before returning failure; rebuild and deploy the corrected kernel or distribution package containing the arm_scmi change.

How to confirm the fix worked

Inspect the arm_scmi source for the corrected rollback logic in scmi_protocol_table_register(); boot the patched kernel and exercise module load/unload sequences that previously left dangling entries, confirming no use-after-free warnings appear in the kernel log.

Typical attack path

1. Load a malicious or malformed SCMI driver module that partially populates the protocol table
2. Trigger a registration failure on a later entry
3. Unload the module, releasing the storage that holds the ID table
4. Cause the kernel to walk or dereference the remaining stale protocol entry

How to detect it

Search kernel logs and dmesg for arm_scmi registration failure messages followed by use-after-free or slab corruption reports; examine module load/unload traces around the time of any SCMI-related oops.

• scmi_protocol_table_register
• arm_scmi.*partial.*registration
• use-after-free.*scmi

What your security team should do

• Prioritize kernel updates on systems exposing the SCMI interface
• Harden module-loading policies to reduce the chance of partial registration scenarios
• Monitor kernel logs for arm_scmi registration errors and use-after-free reports