UBUNTU-CVE-2026-90397: Null Pointer Dereference

In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: scm: Fix NULL dereference in IRQ handler before scm is published In qcomscmprobe(), devmrequestthreadedirq() is called before smpstorerelease(&scm, scm). Two paths can dereference scm before it is published, both causing a NULL pointer dereference. The IRQ handler receives scm via its data argument but passes only wqctx to qcomscmwaitqwakeup() and qcomscmgetcompletion(), which then dereference scm directly. Thread scm through both functions so the IRQ handler path never touches scm. Non-atomic SMC calls made during probe (e.g. from qcomtzmeminit via qcomscmshmbridgeenable) can return WAITQSLEEP, causing qcomscmwaitforwqcompletion() to run before scm is published and dereference it. Add platformsetdrvdata(pdev, scm) early in probe and change qcomscmwaitforwqcompletion() to take the device pointer and use devgetdrvdata() to reach scm, removing any dependency on scm.