CVE-2026-92506: firmware: arm_scmi: Fix requested device removal race
In the Linux kernel, the following vulnerability has been resolved:
firmware: armscmi: Fix requested device removal race
scmiprotocoldeviceunrequest() drops scmirequesteddevicesmtx while notifying listeners but continues to retain the per-protocol list head. When two SCMI drivers for the same protocol unregister concurrently, one thread can remove the final request and free the list head while the other is running its notifier. The latter then dereferences the freed list head after reacquiring the mutex and can free it a second time.
Complete the list and IDR updates, including freeing an empty list head, before dropping the mutex. Keep the blocking notifier outside the critical section and retain only the detached request across the callback.
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
Two SCMI drivers for the same protocol must unregister concurrently. The race occurs when one unregister operation removes the final request and frees the per-protocol list head while the other operation is executing its notifier callback.
What is the likely impact if the race is triggered?
The remaining unregistering thread can dereference a freed list head after it reacquires the mutex, and may free that list head a second time. This is a use-after-free and double-free condition in the Linux kernel SCMI device-request removal path.
How can the issue be addressed?
Apply a kernel update containing the referenced stable commits. The fix completes list and IDR updates, including freeing an empty list head, before releasing the mutex for blocking notifier execution.