firmware: arm_scmi: Drop handle on protocol bind failures
Severity and exploitation
KEV coverage does not rule out exploitation.
Severity
unknownCVSS measures technical severity, not the likelihood of an attack.
Known exploitation
Not listed in the checked CISA KEV catalog
Absence from CISA KEV does not rule out attacks.
Public exploit
Not established by this record
Missing evidence does not mean no public exploit exists.
Remediation
Fix status not established
No structured fix or guidance is available here. Check the latest publisher advisory.
What this means
In the Linux kernel, the following vulnerability has been resolved:
Source excerpt · LinuxAttack conditions
No attack-condition excerpt has been identified here. Review the full source description and references for authentication, network access, and configuration requirements.
Review supporting sources →Affected versions
Check the exact model, release, and any platform requirements against your installation.
Linux · Linux
Linux
6 ranges
Linux · Linux
Linux
Compare with this publisher’s ranges. This does not inspect your installation.
affected
b50c9270304cfed6ee1c4ce5036102ad7b762051 → before b5377e690cd4fe87ee52fcf067c9929414ea8f4e
git versions
971fc0665f1361f23251e4d85fac4aed1b683505 → before 0f860db24ee95e5da4866303a35e55098b9641b3
git versions
971fc0665f1361f23251e4d85fac4aed1b683505 → before df273eced7cec550465fd1bb82a5d2c3c7d3c437
git versions
971fc0665f1361f23251e4d85fac4aed1b683505 → before a54dc23e8bd2246c28eafffa60b4634f0d1a11cc
git versions
971fc0665f1361f23251e4d85fac4aed1b683505 → before 77d2985d1e80e67f32026fc03e975c4c83cc543d
git versions
971fc0665f1361f23251e4d85fac4aed1b683505 → before e3a5c30d233ca5d3e799a80da806554c703bda13
git versions
Other versions: unaffected
Linux · Linux
Linux
7 ranges
Linux · Linux
Linux
Compare with this publisher’s ranges. This does not inspect your installation.
affected
6.3
unaffected
0 → before 6.3
semver versions
6.6.157 → through 6.6.*
semver versions
6.12.110 → through 6.12.*
semver versions
6.18.52 → through 6.18.*
semver versions
7.2.6 → through 7.2.*
semver versions
7.3 → through *
original_commit_for_fix versions
Other versions: affected
What to do
Compare your installed product and version with the affected versions above. A matching product name alone does not confirm exposure.
No structured fix or remediation guidance is available here. Check the full source description and vendor’s latest advisory for a patch or workaround; do not assume another version is safe.
cve.new guidance unless attributed to a publisher. This page does not inspect your installation.
Public exploit evidence
No public exploit reference is identified in the imported evidence. This is not a claim that no exploit exists.
Original source description
Read the full publisher description
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_scmi: Drop handle on protocol bind failures
The SCMI bus notifier acquires an SCMI handle when the driver core emits BUS_NOTIFY_BIND_DRIVER, before invoking the protocol driver probe callback. The protocol probe path only checks whether sdev->handle is set.
If device_link_add() fails after the handle has been acquired, the protocol device can still bind with a valid handle but without the dependency link to the SCMI parent. A concurrent parent unbind can then miss the child and tear down the SCMI instance while the child still holds a handle into it.
If the protocol driver probe later fails, for example with -EPROBE_DEFER, the driver core emits BUS_NOTIFY_DRIVER_NOT_BOUND rather than BUS_NOTIFY_UNBOUND_DRIVER. The SCMI notifier only released the handle on BUS_NOTIFY_UNBOUND_DRIVER, so each failed protocol-device bind leaked the SCMI instance users refcount and left sdev->handle set after the failed probe.
Make the link helper report failure and drop the acquired handle if the link cannot be created. Also handle BUS_NOTIFY_DRIVER_NOT_BOUND in the same cleanup path used for unbind so failed probes balance the earlier BUS_NOTIFY_BIND_DRIVER acquisition.
References
6 sourcesInside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-93084View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Environment requirements
These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.
Linux · platform conditions
Any condition may hold
Vulnerable product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*From (inclusive): 6.3
Before: 6.6.157
Vulnerable product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*From (inclusive): 6.3
Before: 6.12.110
Vulnerable product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*From (inclusive): 6.3
Before: 6.18.52
Vulnerable product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*From (inclusive): 6.3
Before: 7.2.6
Vulnerable product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*From (inclusive): 6.3
Before: 7.3
Applicability preview
[
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.3",
"versionEndExcluding": "6.6.157"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.3",
"versionEndExcluding": "6.12.110"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.3",
"versionEndExcluding": "6.18.52"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.3",
"versionEndExcluding": "7.2.6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.3",
"versionEndExcluding": "7.3"
}
]
}
]
}
]Contributing organizations · 1
Assigning organization
Timeline
All times UTCAdvisory published
Publication date supplied by the source.
Source updated
Latest modification date supplied by the source.
Last imported by cve.new
Latest catalog import, not the date we first saw this advisory.
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.