CVE-2026-93082: firmware: arm_scmi: Unwind P2A receiver mailbox setup failure
In the Linux kernel, the following vulnerability has been resolved:
firmware: armscmi: Unwind P2A receiver mailbox setup failure
mailboxchansetup() can request an additional P2A receiver channel after successfully acquiring the primary P2A channel. If that later request fails, the function returns immediately and leaves the primary channel allocated.
Unwind the primary mailbox channel before returning the error so probe deferral or other setup failures do not leave the channel busy for later probe attempts.
Event History
Frequently Asked Questions
What conditions trigger the channel leak?
The leak occurs when mailbox_chan_setup() successfully acquires the primary P2A channel, then fails while requesting an additional P2A receiver channel. This can happen during probe deferral or other mailbox setup failures.
What is the operational impact of a failed setup attempt?
The primary P2A mailbox channel remains allocated and busy after the failure. Later probe attempts may be unable to acquire that channel.
What does the fix change?
The fix releases the primary mailbox channel before returning an error when setup of the additional P2A receiver channel fails.