Cloudanix VulnDB

CVE-2026-93090

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux kernel startup code for certain hardware controllers could leave memory resources dangling, potentially letting an attacker who already has access to the machine cause crashes or gain more control.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Improper cleanup of partially registered SCMI transport channels, devices, and IDR entries on scmi_channels_setup() failure leaves kernel resources allocated, enabling memory corruption or use-after-free conditions in the probe error path.

Why it matters to the business

Linux systems using ARM SCMI firmware may experience kernel instability, crashes, or resource exhaustion during driver initialization failures, increasing downtime risk on affected hardware.

How an attack unfolds

An attacker with local access triggers a deliberate or natural failure in scmi_channels_setup() after partial channel registration, then leverages the leaked or uncleared kernel objects for memory corruption primitives to escalate privileges or cause denial of service.

How to fix it

Apply the upstream kernel commit that routes setup failures through the channel cleanup label; rebuild and deploy updated kernel images containing the fix for all affected ARM platforms.

How to confirm the fix worked

Confirm the patch is present by inspecting the scmi_channels_setup() error handling path for the goto cleanup label; test probe failure scenarios and verify no orphaned IDR entries or devices remain.

Typical attack path

  1. Obtain local code execution on target Linux system
  2. Force SCMI probe path to invoke scmi_channels_setup() and induce failure after BASE or protocol channels register
  3. Reuse dangling IDR or transport device references to corrupt kernel memory
  4. Escalate to arbitrary code execution or system crash

How to detect it

Review kernel logs for SCMI probe errors followed by resource accounting anomalies; inspect IDR dumps or kmemleak reports after module load failures for evidence of uncleared channel state.

What your security team should do

  • Prioritize kernel updates on all ARM-based Linux deployments within standard change windows
  • Monitor upstream stable branches for backports of the cleanup fix
  • Add kernel memory leak and probe failure alerts to existing observability tooling

The record

In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Clean up channels on setup failure scmi_channels_setup() can fail after the common BASE channel or earlier protocol channels have already been registered in the TX/RX IDRs. Route this failure through the existing channel cleanup label so the transport channels, transport devices and IDR state created before the failure are released before the probe error path frees the SCMI instance ID.

Affected packages

Ecosystem Package Introduced Fixed