CVE-2026-93082

What it actually does

Failure to release a successfully acquired primary P2A mailbox channel when a subsequent secondary P2A receiver channel allocation fails, leaving the channel marked busy and blocking later driver probe attempts.

Why it matters to the business

Systems using ARM SCMI firmware may experience repeated driver initialization failures after transient mailbox setup errors, resulting in degraded boot reliability or the need for manual intervention to recover the affected hardware.

How an attack unfolds

An attacker with the ability to trigger or observe mailbox channel allocation sequences during kernel module loading can induce the error path, leaving the primary channel allocated and preventing subsequent successful probes of the SCMI controller.

How to fix it

Update to a Linux kernel version containing the commit that unwinds the primary mailbox channel allocation on secondary channel failure before returning the error.

How to confirm the fix worked

Confirm the presence of the unwind logic in mailbox_chan_setup by inspecting the arm_scmi mailbox setup code path and verify that probe deferral or repeated load attempts succeed after a secondary channel failure.

Typical attack path

1. Trigger conditions that cause mailbox_chan_setup to acquire the primary P2A channel
2. Force failure of the additional P2A receiver channel request
3. Observe that the primary channel remains allocated and subsequent probe attempts fail

How to detect it

Review kernel logs and dmesg output around arm_scmi and mailbox driver initialization for repeated allocation or probe failure messages indicating a busy primary channel.

What your security team should do

• Apply the upstream fix in all kernels that include the arm_scmi mailbox driver
• Monitor boot and driver probe logs for repeated mailbox allocation failures on affected hardware
• Prioritize updates on systems where SCMI firmware is required for platform management