CVE-2026-93089

What it actually does

Missing invocation of the transport-specific chan_free() callback in the error path when IDR insertion fails after successful channel setup, leaving IRQs, mailbox channels, and shared memory mappings unreleased.

Why it matters to the business

Repeated triggering of the error condition on affected Linux systems can lead to gradual resource exhaustion, potential instability in firmware-managed hardware interfaces, and increased operational overhead for kernel maintenance on embedded or server platforms using SCMI.

How an attack unfolds

An attacker with the ability to induce repeated failures during SCMI transport channel registration (for example through concurrent device probing or resource pressure) can cause the kernel to leak transport resources without proper cleanup, potentially contributing to denial-of-service conditions over time.

How to fix it

Update to a Linux kernel version containing the fix that ensures chan_free() is invoked before device destruction in the IDR failure path; rebuild and deploy the kernel image across affected systems.

How to confirm the fix worked

Inspect the arm_scmi transport teardown code to confirm chan_free() is called prior to device destruction; monitor for resource leaks during error injection tests on SCMI channel registration.

Typical attack path

1. Identify or create conditions that allow SCMI transport channel setup to succeed.
2. Force an IDR insertion failure during subsequent registration.
3. Observe that the error teardown path omits the chan_free() call.
4. Repeat to accumulate leaked IRQs, mailbox channels, or memory mappings.

How to detect it

Examine kernel logs and SCMI driver traces for repeated transport channel setup followed by abrupt device destruction without cleanup callbacks; correlate with resource accounting counters for IRQs and memory mappings.

What your security team should do

• Prioritize kernel updates on systems exposing SCMI interfaces, especially embedded and server platforms.
• Review boot and device-probing logs for repeated SCMI transport setup failures.
• Apply the fix in any downstream kernel forks or distributions within standard patch cycles.