firmware: arm_scmi: Fix requested device removal race
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Fix requested device removal race scmi_protocol_device_unrequest() drops scmi_requested_devices_mtx while notifying listeners but continues to retain the per-protocol list head. When two SCMI drivers for the same protocol unregister concurrently, one thread can remove the final request and free the list head while the other is running its notifier. The latter then dereferences the freed list head after reacquiring the mutex and can free it a second time. Complete the list and IDR updates, including freeing an empty list head, before dropping the mutex. Keep the blocking notifier outside the critical section and retain only the detached request across the callback.
CVE-2026-92506
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-92506
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "d3cd7c525fd2ecce3a6c963f314969a54783d211",
"lessThan": "2ff7713b7308cd6bea3328f7cd750b5eaab42af3",
"versionType": "git"
},
{
"status": "affected",
"version": "d3cd7c525fd2ecce3a6c963f314969a54783d211",
"lessThan": "1c35915eaaa81a12340c838c5c2ccb02be2194c3",
"versionType": "git"
},
{
"status": "affected",
"version": "d3cd7c525fd2ecce3a6c963f314969a54783d211",
"lessThan": "c3d4ef1c0ca6917aad6f1093b49f3932944a8c19",
"versionType": "git"
},
{
"status": "affected",
"version": "d3cd7c525fd2ecce3a6c963f314969a54783d211",
"lessThan": "21d35c5f46e99e9047bb9ded3ecb5ab440dd75b3",
"versionType": "git"
},
{
"status": "affected",
"version": "d3cd7c525fd2ecce3a6c963f314969a54783d211",
"lessThan": "2c4097e6c4aed276c5e9ec2ab331ab397ea780bf",
"versionType": "git"
}
],
"programFiles": [
"drivers/firmware/arm_scmi/bus.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.3",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/firmware/arm_scmi/bus.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-92506
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #37754 · Revision 1
- Added to Heist Feed
- Publisher date