CVE-2026-93086: firmware: arm_scmi: Avoid IDR updates while cleaning channels
firmware: armscmi: Avoid IDR updates while cleaning channels
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1
Event History
Frequently Asked Questions
When can this issue be triggered?
It is relevant when the SCMI subsystem cleans up its transmit and receive transport channels. The unsafe behavior occurs because the cleanup callback removes entries from an IDR while that same IDR is being traversed.
What is the practical failure mode?
Removing the currently visited IDR entry during idr_for_each() can invalidate the radix-tree iterator state. The cleanup callback cannot simply be made RCU-protected because device destruction may sleep.
What does the fix change?
The fix stops the cleanup callback from updating the IDRs. It limits the callback to destroying devices and leaves IDR teardown to the subsequent idr_destroy() call.