GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2026-93086

Vulnerability from fkie_nvd - Published: 2026-09-17 17:18 - Updated: 2026-09-17 17:18
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Avoid IDR updates while cleaning channels scmi_cleanup_channels() walks the TX/RX channel IDRs with idr_for_each() to free transport resources and destroy the dedicated transport devices before calling idr_destroy(). The destroy callback removed each entry from the same IDR being walked. That is not needed for this cleanup path, and it is unsafe because idr_for_each() has not advanced its radix-tree iterator while the callback is running. Removing the current entry from the callback can invalidate the iterator state. The callback also cannot be protected by rcu_read_lock(), because scmi_device_destroy() may sleep. Leave IDR teardown to the following idr_destroy() call and keep the callback limited to device destruction.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/431c6b872ba7fedcc5a3afb0ec3517db4d95d088
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/54e5a4f7d83db4552d963d0785be32d9df680dcd
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/aed24a3c63920539e9de7fbfe7929a2e7c888cd2
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/bab26acebe55e8ad3ab545abda72faa7ca28c477
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c38b1e19485aaa820e52cfe162525a8af67563da
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/firmware/arm_scmi/driver.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "aed24a3c63920539e9de7fbfe7929a2e7c888cd2",
              "status": "affected",
              "version": "05a2801d8b90c1b5159618d4bd3a3c65d60f3ff1",
              "versionType": "git"
            },
            {
              "lessThan": "431c6b872ba7fedcc5a3afb0ec3517db4d95d088",
              "status": "affected",
              "version": "05a2801d8b90c1b5159618d4bd3a3c65d60f3ff1",
              "versionType": "git"
            },
            {
              "lessThan": "54e5a4f7d83db4552d963d0785be32d9df680dcd",
              "status": "affected",
              "version": "05a2801d8b90c1b5159618d4bd3a3c65d60f3ff1",
              "versionType": "git"
            },
            {
              "lessThan": "bab26acebe55e8ad3ab545abda72faa7ca28c477",
              "status": "affected",
              "version": "05a2801d8b90c1b5159618d4bd3a3c65d60f3ff1",
              "versionType": "git"
            },
            {
              "lessThan": "c38b1e19485aaa820e52cfe162525a8af67563da",
              "status": "affected",
              "version": "05a2801d8b90c1b5159618d4bd3a3c65d60f3ff1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/firmware/arm_scmi/driver.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Avoid IDR updates while cleaning channels\n\nscmi_cleanup_channels() walks the TX/RX channel IDRs with\nidr_for_each() to free transport resources and destroy the dedicated\ntransport devices before calling idr_destroy().\n\nThe destroy callback removed each entry from the same IDR being walked.\nThat is not needed for this cleanup path, and it is unsafe because\nidr_for_each() has not advanced its radix-tree iterator while the\ncallback is running. Removing the current entry from the callback can\ninvalidate the iterator state. The callback also cannot be protected by\nrcu_read_lock(), because scmi_device_destroy() may sleep.\n\nLeave IDR teardown to the following idr_destroy() call and keep the\ncallback limited to device destruction."
    }
  ],
  "id": "CVE-2026-93086",
  "lastModified": "2026-09-17T17:18:02.713",
  "metrics": {},
  "published": "2026-09-17T17:18:02.713",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/431c6b872ba7fedcc5a3afb0ec3517db4d95d088"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/54e5a4f7d83db4552d963d0785be32d9df680dcd"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/aed24a3c63920539e9de7fbfe7929a2e7c888cd2"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/bab26acebe55e8ad3ab545abda72faa7ca28c477"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/c38b1e19485aaa820e52cfe162525a8af67563da"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.