Cloudanix VulnDB

CVE-2026-93084

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A setup error in the Linux kernel's hardware communication layer can leave behind invalid references that may cause crashes or allow attackers to interfere with system memory later on.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in Linux kernel SCMI bus notifier: handle acquired on BUS_NOTIFY_BIND_DRIVER is not released on device_link_add failure or BUS_NOTIFY_DRIVER_NOT_BOUND, allowing concurrent parent unbind to free the SCMI instance while child protocol device still holds a reference.

Why it matters to the business

Potential kernel crashes, memory corruption, or privilege escalation on Linux systems using SCMI firmware interfaces; low exploitability reduces immediate risk but still requires patching to avoid stability issues in affected embedded and server deployments.

How an attack unfolds

An attacker triggers repeated SCMI protocol device bind attempts that fail after handle acquisition (via link creation error or -EPROBE_DEFER), causing reference count leaks; a concurrent parent unbind then frees the instance, and subsequent use of the dangling handle by the child leads to use-after-free.

How to fix it

Update the Linux kernel to a version containing the fix that makes the link helper report failure and releases the handle on both BUS_NOTIFY_UNBOUND_DRIVER and BUS_NOTIFY_DRIVER_NOT_BOUND paths.

How to confirm the fix worked

Inspect kernel source for the updated notifier logic handling BUS_NOTIFY_DRIVER_NOT_BOUND and link failure paths; verify no handle leaks remain after failed protocol probes via code review or targeted fuzzing of SCMI bind sequences.

Typical attack path

  1. Trigger SCMI protocol device enumeration and bind notification
  2. Force device_link_add failure or probe deferral after handle acquisition
  3. Induce concurrent SCMI parent unbind while leaked handle remains
  4. Access the now-freed SCMI instance via the stale child handle

How to detect it

Search kernel logs and crash dumps for SCMI notifier events involving bind failures, handle leaks, or use-after-free oops referencing arm_scmi or sdev->handle; correlate with BUS_NOTIFY_* events in driver core traces.

  • BUS_NOTIFY_DRIVER_NOT_BOUND
  • arm_scmi.*handle
  • device_link_add.*failed.*SCMI

What your security team should do

  • Apply the upstream SCMI handle-release fix as soon as a stable kernel update is available
  • Monitor kernel oops and SCMI-related error logs for signs of bind failures
  • Prioritize updates on systems exposing SCMI firmware interfaces

The record

In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Drop handle on protocol bind failures The SCMI bus notifier acquires an SCMI handle when the driver core emits BUS_NOTIFY_BIND_DRIVER, before invoking the protocol driver probe callback. The protocol probe path only checks whether sdev->handle is set. If device_link_add() fails after the handle has been acquired, the protocol device can still bind with a valid handle but without the dependency link to the SCMI parent. A concurrent parent unbind can then miss the child and tear down the SCMI instance while the child still holds a handle into it. If the protocol driver probe later fails, for example with -EPROBE_DEFER, the driver core emits BUS_NOTIFY_DRIVER_NOT_BOUND rather than BUS_NOTIFY_UNBOUND_DRIVER. The SCMI notifier only released the handle on BUS_NOTIFY_UNBOUND_DRIVER, so each failed protocol-device bind leaked the SCMI instance users refcount and left sdev->handle set after the failed probe. Make the link helper report failure and drop the acquired handle if the link cannot be created. Also handle BUS_NOTIFY_DRIVER_NOT_BOUND in the same cleanup path used for unbind so failed probes balance the earlier BUS_NOTIFY_BIND_DRIVER acquisition.

Affected packages

Ecosystem Package Introduced Fixed