Skip to content
Heist/ feed
Unrated

firmware: arm_scmi: Publish channel state before callbacks

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Publish channel state before callbacks Transport setup can enable callbacks before the setup routine returns. mailbox_chan_setup() registers the mailbox client with mbox_request_channel(), and the mailbox controller startup path can enable interrupt delivery before SCMI mailbox channel state has been published. Similarly, smc_chan_setup() requests the optional A2P completion IRQ before the SMC transport has made its cinfo pointer visible. If a pending or spurious callback fires in those windows, the transport RX callback can dereference a NULL transport cinfo pointer. Publishing only the transport-private pointer is not sufficient either: an early callback can enter the SCMI core before scmi_chan_setup() has assigned cinfo->handle. The core derives scmi_info from cinfo->handle in the RX path, so a NULL handle can still fault even when the transport-private cinfo is valid. Assign cinfo->handle before invoking the transport setup callback. Publish the mailbox and SMC transport-private channel state before requesting the mailbox channels or IRQ, and clear the early-published pointers again on setup failure. Also unwind mailbox setup devres resources on failure so an optional RX setup error that is ignored by the core does not leave stale transport state behind.

Announced Source revision 1
Original source ↗

CVE-2026-93093

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-93093

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5c8a47a5a91d4d6e185f758d61997613d9c5d6ac",
        "lessThan": "50e38091a657ad81385e2aea7e2575e17ac23d79",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "5c8a47a5a91d4d6e185f758d61997613d9c5d6ac",
        "lessThan": "6f3f532531e4a27d28a2240719d1b05ac11766c6",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "5c8a47a5a91d4d6e185f758d61997613d9c5d6ac",
        "lessThan": "1bea027f7ef6fb889628b16c568a5f7c07a51b30",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "5c8a47a5a91d4d6e185f758d61997613d9c5d6ac",
        "lessThan": "a1bc587568a4e373db76261dc9561dfc3653917f",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "5c8a47a5a91d4d6e185f758d61997613d9c5d6ac",
        "lessThan": "0314900dcdde044af0208fed212035dbfaa55843",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/firmware/arm_scmi/driver.c",
      "drivers/firmware/arm_scmi/transports/mailbox.c",
      "drivers/firmware/arm_scmi/transports/smc.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.7"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.7",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "6.6.160",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.110",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.52",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.2.6",
        "versionType": "semver",
        "lessThanOrEqual": "7.2.*"
      },
      {
        "status": "unaffected",
        "version": "7.3",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/firmware/arm_scmi/driver.c",
      "drivers/firmware/arm_scmi/transports/mailbox.c",
      "drivers/firmware/arm_scmi/transports/smc.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-93093

Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event
#48707 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement