Cloudanix VulnDB

CVE-2026-93085

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how the system reads hardware configuration data could let invalid settings slip through and confuse important communication channels inside the kernel.

Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
High
Impact
Other
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Improper validation of SCMI protocol IDs from device tree allows out-of-range 32-bit values to reach u8-handling code, resulting in truncation, misidentification as a different protocol, or aliasing of IDR keys during channel setup and protocol device creation.

Why it matters to the business

Systems relying on ARM SCMI firmware interfaces may experience unexpected protocol misbehavior or resource aliasing during boot or device initialization, potentially affecting stability or security posture on affected embedded and server platforms.

How an attack unfolds

An attacker supplies a crafted device tree containing an out-of-range protocol ID in a reg property; the kernel parses it without rejection, passes the truncated or aliased value into SCMI helpers, and the resulting misconfigured channel or protocol device can be leveraged for further abuse such as protocol confusion or denial of service.

How to fix it

Apply the upstream kernel patch that rejects DT nodes whose reg value does not fit within the SCMI protocol ID field before channel setup or device creation; rebuild and deploy the fixed kernel image.

How to confirm the fix worked

Confirm the presence of the check that skips protocol nodes with out-of-range reg values in arm_scmi DT parsing code; test by attempting to load a DT containing an invalid protocol ID and verifying that an error is logged and processing is aborted.

Typical attack path

  1. Obtain ability to influence or replace the device tree blob passed to the kernel
  2. Insert a DT node with a reg value exceeding MSG_PROTOCOL_ID_MASK for an SCMI protocol
  3. Trigger kernel boot or SCMI channel initialization
  4. Observe or exploit the resulting protocol aliasing or truncation effects

How to detect it

Review kernel boot logs for SCMI-related error messages mentioning out-of-range protocol IDs; examine device tree sources or compiled blobs for reg properties exceeding the protocol ID mask.

What your security team should do

  • Prioritize kernel updates on all ARM systems using SCMI
  • Audit custom device trees for protocol ID values outside the valid mask range
  • Monitor for future backports to supported LTS kernels

The record

In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Reject out of range DT protocol IDs SCMI protocol IDs carried in message headers are limited by MSG_PROTOCOL_ID_MASK. The DT parsing paths noticed protocol IDs outside that range, but only logged an error and then kept processing the invalid value. That lets a malformed 32-bit DT reg value reach helpers which take a u8 protocol ID, where it can be truncated and/or treated as a different protocol. For channel setup, two different out-of-range values can also be used as distinct IDR keys while aliasing the generated SCMI protocol identity. Skip DT protocol nodes whose reg value does not fit the SCMI protocol ID field before setting up channels or creating protocol devices.

Affected packages

Ecosystem Package Introduced Fixed