CVE-2026-93083

What it actually does

mailbox_chan_setup fails to release the primary mailbox channel when the secondary unidirectional TX receiver channel allocation fails, leaving the primary channel allocated and unavailable for subsequent attempts.

Why it matters to the business

ARM systems relying on SCMI firmware may encounter repeated driver probe failures or deferred initialization, leading to reduced hardware functionality or boot instability until the system is updated.

How an attack unfolds

An attacker with local access could trigger repeated probe error paths during arm_scmi initialization to hold mailbox resources, but the flaw is primarily a resource-leak bug rather than a direct remote attack vector.

How to fix it

Apply the upstream kernel fix that adds unwind of the primary mailbox channel before returning the error from mailbox_chan_setup; rebuild and deploy the corrected kernel image.

How to confirm the fix worked

Inspect the arm_scmi mailbox_chan_setup source for the added unwind path on secondary channel failure; verify driver probes succeed after error injection in test environments.

Typical attack path

1. Load or trigger arm_scmi driver probe on affected kernel
2. Force failure in secondary TX receiver mailbox request
3. Observe primary channel left allocated and unavailable

How to detect it

Review kernel ring buffer and dmesg logs for mailbox allocation failures or repeated arm_scmi probe deferrals indicating the leak condition.

What your security team should do

• Prioritize kernel updates on all ARM platforms using SCMI
• Monitor for probe deferral or mailbox allocation warnings in dmesg
• Test driver initialization under simulated allocation failures before production rollout