CVE-2026-90397

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published

In qcom_scm_probe(), devm_request_threaded_irq() is called before

smp_store_release(&__scm, scm). Two paths can dereference __scm before

it is published, both causing a NULL pointer dereference.

The IRQ handler receives scm via its data argument but passes only wq_ctx

to qcom_scm_waitq_wakeup() and qcom_scm_get_completion(), which then

dereference __scm directly. Thread scm through both functions so the IRQ

handler path never touches __scm.

Non-atomic SMC calls made during probe (e.g. from qcom_tzmem_init via

qcom_scm_shm_bridge_enable) can return WAITQ_SLEEP, causing

qcom_scm_wait_for_wq_completion() to run before __scm is published and

dereference it. Add platform_set_drvdata(pdev, scm) early in probe and

change qcom_scm_wait_for_wq_completion() to take the device pointer and

use dev_get_drvdata() to reach scm, removing any depende

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References