CVE-2026-93084

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_scmi: Drop handle on protocol bind failures

The SCMI bus notifier acquires an SCMI handle when the driver core emits

BUS_NOTIFY_BIND_DRIVER, before invoking the protocol driver probe

callback. The protocol probe path only checks whether sdev->handle is

set.

If device_link_add() fails after the handle has been acquired, the

protocol device can still bind with a valid handle but without the

dependency link to the SCMI parent. A concurrent parent unbind can then

miss the child and tear down the SCMI instance while the child still

holds a handle into it.

If the protocol driver probe later fails, for example with

-EPROBE_DEFER, the driver core emits BUS_NOTIFY_DRIVER_NOT_BOUND rather

than BUS_NOTIFY_UNBOUND_DRIVER. The SCMI notifier only released the

handle on BUS_NOTIFY_UNBOUND_DRIVER, so each failed protocol-device bind

leaked the SCMI instance users refcount and left sdev->handle set after

the failed pr

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References