CVE-2026-93090: firmware: arm_scmi: Clean up channels on setup failure
In the Linux kernel, the following vulnerability has been resolved:
firmware: armscmi: Clean up channels on setup failure
scmichannelssetup() can fail after the common BASE channel or earlier protocol channels have already been registered in the TX/RX IDRs.
Route this failure through the existing channel cleanup label so the transport channels, transport devices and IDR state created before the failure are released before the probe error path frees the SCMI instance ID.
Event History
Frequently Asked Questions
When can this issue be triggered?
It can occur when scmi_channels_setup() fails after the common BASE channel or earlier protocol channels have already been registered in the TX/RX IDRs during SCMI setup.
What resources may be left behind after a failed setup?
Previously created transport channels, transport devices, and TX/RX IDR state may not be released before the probe error path frees the SCMI instance ID.
What does the fix change?
The fix routes channel-setup failures through the existing channel cleanup path, releasing resources created before the failure.