CVE-2026-92490: firmware: arm_scmi: Unrequest devices if driver registration fails
In the Linux kernel, the following vulnerability has been resolved:
firmware: armscmi: Unrequest devices if driver registration fails
scmidriverregister() requests protocol devices before registering the driver. If driverregister() fails, those requests remain in the global IDR and retain pointers to the module's ID table. Once the failed module load releases that storage, later request matching or SCMI device creation can dereference the stale pointers.
Unrequest the complete protocol table before returning the registration failure. At this point table registration succeeded, so every entry is owned by the current registration attempt.
Affected Software
Event History
Frequently Asked Questions
Under what condition does the stale state remain after a failed module load?
It remains when SCMI protocol devices have been requested and driver registration subsequently fails. The requested devices stay in the global IDR even though the module load releases the driver's ID-table storage.
What can happen after the failed registration attempt?
Later request matching or SCMI device creation can dereference pointers to the released module ID table. This occurs because the retained protocol-device requests still reference that storage.
What does the fix change?
On driver-registration failure, it unregisters the complete protocol table before returning the error. The data states that all entries are owned by the current registration attempt at that point.