Cloudanix VulnDB

CVE-2026-93092

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing flaw in Linux could let certain hardware removal operations cause crashes on affected systems.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Other
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in SCMI firmware subsystem where a device notifier callback can access an IDR (active_protocols) that is concurrently being destroyed during module or device removal, leading to invalid memory access or use-after-free.

Why it matters to the business

Potential kernel crashes or system instability on Linux systems using SCMI-based firmware interfaces, increasing downtime risk in embedded, server, and ARM-based environments; low immediate urgency given absent exploitation data.

How an attack unfolds

An attacker with local access triggers timed device or module removal operations that activate the notifier while the IDR teardown is in progress, attempting to cause memory corruption or denial of service via the race window.

How to fix it

Update to a Linux kernel version containing the fix that unregisters the notifier before IDR teardown; apply vendor-supplied kernel updates as they become available.

How to confirm the fix worked

Confirm kernel source contains the described notifier-unregister-before-IDR-teardown ordering in arm_scmi remove path; test module load/unload and device removal under concurrency for absence of crashes.

Typical attack path

  1. Obtain local code execution on affected Linux kernel
  2. Load or interact with arm_scmi driver
  3. Trigger concurrent device removal and protocol teardown
  4. Race notifier callback against IDR destruction to induce crash or corruption

How to detect it

Review kernel logs for oops/panic traces referencing arm_scmi, active_protocols IDR, or notifier callbacks during module removal; no public exploitation artifacts known.

What your security team should do

  • Prioritize kernel updates on systems exposing SCMI interfaces
  • Monitor vendor advisories for backported fixes
  • Restrict unprivileged local access on high-value ARM/Linux hosts until patched

The record

In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Unregister device notifier before IDR teardown The requested-devices notifier looks up protocol fwnodes from the active_protocols IDR. During remove, unregister the notifier before releasing and destroying active_protocols so no notifier callback can race with the IDR teardown. Keep the bus notifier registered until after the protocol state is torn down, matching the existing remove ordering for SCMI bus users.

Affected packages

Ecosystem Package Introduced Fixed