UBUNTU-CVE-2026-93092: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Unregister device notifier before IDR teardown The requested-devices notifier looks up protocol fwnodes from the activeprotocols IDR. During remove, unregister the notifier before releasing and destroying activeprotocols so no notifier callback can race with the IDR teardown. Keep the bus notifier registered until after the protocol state is torn down, matching the existing remove ordering for SCMI bus users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Operational
During device removal, unregister the requested-devices notifier before releasing and destroying the active_protocols IDR; keep the bus notifier registered until after the protocol state is torn down.
Event History
Frequently Asked Questions
When can this race occur?
It can occur during removal of the ARM SCMI firmware driver, if the requested-devices notifier callback runs while the active_protocols IDR is being released and destroyed.
What component must be in use for a system to be exposed?
The affected code is in the Linux kernel ARM SCMI firmware subsystem. The provided data does not establish whether any particular default Ubuntu configuration enables or uses this subsystem.
What does the fix change?
The fix unregisters the requested-devices notifier before tearing down active_protocols, preventing its callback from accessing protocol fwnodes through an IDR that is being destroyed. The SCMI bus notifier remains registered until protocol state teardown is complete.