UBUNTU-CVE-2026-93084: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Drop handle on protocol bind failures The SCMI bus notifier acquires an SCMI handle when the driver core emits BUSNOTIFYBINDDRIVER, before invoking the protocol driver probe callback. The protocol probe path only checks whether sdev->handle is set. If devicelinkadd() fails after the handle has been acquired, the protocol device can still bind with a valid handle but without the dependency link to the SCMI parent. A concurrent parent unbind can then miss the child and tear down the SCMI instance while the child still holds a handle into it. If the protocol driver probe later fails, for example with -EPROBEDEFER, the driver core emits BUSNOTIFYDRIVERNOTBOUND rather than BUSNOTIFYUNBOUNDDRIVER. The SCMI notifier only released the handle on BUSNOTIFYUNBOUNDDRIVER, so each failed protocol-device bind leaked the SCMI instance users refcount and left sdev->handle set after the failed probe. Make the link helper report failure and drop the acquired handle if the link cannot be created. Also handle BUSNOTIFYDRIVERNOTBOUND in the same cleanup path used for unbind so failed probes balance the earlier BUSNOTIFYBINDDRIVER acquisition.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Handle BUS_NOTIFY_DRIVER_NOT_BOUND in the same SCMI notifier cleanup path as the unbind notification, releasing the acquired SCMI handle so failed protocol-driver probes balance the earlier BUS_NOTIFY_BIND_DRIVER acquisition.
- Compensating control
Make the device_link_add() helper report failure and drop the acquired SCMI handle when the dependency link cannot be created, preventing a protocol device from binding with a valid handle but without the SCMI-parent dependency link.