CVE-2026-93081: firmware: arm_scmi: Fix SCMI device destroy lifetimes
In the Linux kernel, the following vulnerability has been resolved:
firmware: armscmi: Fix SCMI device destroy lifetimes
scmichilddevfind() drops the reference returned by devicefindchild() before returning the scmidevice pointer. A concurrent unregister can then release the device while the destroy path is still using the returned pointer.
Make the lookup helper return the devicefindchild() reference and keep it until scmidevicedestroy() has finished unregistering the child.
Also split deviceunregister() in scmidevicedestroy() so the SCMI bus ID is not made reusable until after devicedel() has removed the old scmidev.N name from sysfs. This avoids a new SCMI device reusing the same ID while the old device is still registered.
The final device release callback is also a possible cleanup path when SCMI children are deleted by driver core recursion rather than scmidevicedestroy(). Release the SCMI bus ID from a common helper used by destroy, register-failure and final-release paths, and clear scmidev->id after freeing it so the final release cannot free the same ID again.
Affected Software
Event History
Frequently Asked Questions
What conditions are involved in triggering the lifetime issue?
The issue requires a concurrent SCMI child-device unregister while the destroy path is still using a device pointer returned by the child lookup. The affected path previously dropped the reference obtained during lookup before destruction had completed.
Why is SCMI bus ID reuse relevant during device removal?
A bus ID could become reusable before device_del() removed the old scmi_dev.N name from sysfs. A newly created SCMI device could then reuse that ID while the old device was still registered.
Are there multiple cleanup paths that must handle the SCMI bus ID?
Yes. ID release must be handled for normal destruction, registration failure, and final device release. Final release can occur when driver-core recursion deletes SCMI children rather than the normal SCMI destroy path.