CVE-2026-92506: firmware: arm_scmi: Fix requested device removal race
firmware: armscmi: Fix requested device removal race
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
Two SCMI drivers for the same protocol must unregister concurrently. The race occurs when one unregister operation removes the final request and frees the per-protocol list head while the other operation is executing its notifier callback.
What is the likely impact if the race is triggered?
The remaining unregistering thread can dereference a freed list head after it reacquires the mutex, and may free that list head a second time. This is a use-after-free and double-free condition in the Linux kernel SCMI device-request removal path.
How can the issue be addressed?
Apply a kernel update containing the referenced stable commits. The fix completes list and IDR updates, including freeing an empty list head, before releasing the mutex for blocking notifier execution.