UBUNTU-CVE-2026-92506: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Fix requested device removal race scmiprotocoldeviceunrequest() drops scmirequesteddevicesmtx while notifying listeners but continues to retain the per-protocol list head. When two SCMI drivers for the same protocol unregister concurrently, one thread can remove the final request and free the list head while the other is running its notifier. The latter then dereferences the freed list head after reacquiring the mutex and can free it a second time. Complete the list and IDR updates, including freeing an empty list head, before dropping the mutex. Keep the blocking notifier outside the critical section and retain only the detached request across the callback.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this race condition?
The issue affects the listed Ubuntu kernel packages when SCMI drivers for the same protocol are present and can unregister concurrently. It is specific to the Linux kernel SCMI firmware subsystem.
What conditions are required to trigger the vulnerability?
Two SCMI drivers using the same protocol must unregister at the same time. One unregister path must remove the final request and free the per-protocol list head while the other path is executing a notifier callback.
What is the likely result if the race is triggered?
The second unregistering thread can dereference a freed list head after it reacquires the mutex and may free that list head again. This is a use-after-free and double-free condition in the kernel.
How can administrators determine whether their systems may be affected?
Identify whether the system runs one of the listed Ubuntu kernel package families and uses SCMI drivers that may unregister concurrently for the same protocol. The provided data does not include affected or fixed package version numbers.