CVE-2026-93085: firmware: arm_scmi: Reject out of range DT protocol IDs
In the Linux kernel, the following vulnerability has been resolved:
firmware: armscmi: Reject out of range DT protocol IDs
SCMI protocol IDs carried in message headers are limited by MSGPROTOCOLIDMASK. The DT parsing paths noticed protocol IDs outside that range, but only logged an error and then kept processing the invalid value.
That lets a malformed 32-bit DT reg value reach helpers which take a u8 protocol ID, where it can be truncated and/or treated as a different protocol.
For channel setup, two different out-of-range values can also be used as distinct IDR keys while aliasing the generated SCMI protocol identity.
Skip DT protocol nodes whose reg value does not fit the SCMI protocol ID field before setting up channels or creating protocol devices.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.111-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.111-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.157 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.110 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.52 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the Linux kernel SCMI device-tree parsing paths, skip protocol nodes whose reg value does not fit within MSG_PROTOCOL_ID_MASK before setting up channels or creating protocol devices.
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker would need to cause the kernel to parse a malformed Device Tree protocol node whose 32-bit reg value exceeds the SCMI message-header protocol ID mask. The vulnerable paths must process that node during SCMI channel setup or protocol-device creation.
What is the impact of an out-of-range protocol ID?
The invalid value can reach helpers that accept an 8-bit protocol ID, where it may be truncated or interpreted as a different protocol. During channel setup, different out-of-range values can also be tracked as separate IDR keys while aliasing the same generated SCMI protocol identity.
How can exposure be identified?
Review Device Tree SCMI protocol nodes for reg values that do not fit within the SCMI protocol ID field defined by MSG_PROTOCOL_ID_MASK. Systems parsing such invalid nodes are exposed because the prior behavior logged an error but continued processing.
What mitigation is available if the fix cannot be applied immediately?
Ensure SCMI Device Tree protocol nodes with out-of-range reg values are removed or corrected so they fit the SCMI protocol ID field. This prevents invalid protocol nodes from reaching channel setup and protocol-device creation paths.