CVE-2026-93093

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_scmi: Publish channel state before callbacks

Transport setup can enable callbacks before the setup routine returns.

mailbox_chan_setup() registers the mailbox client with

mbox_request_channel(), and the mailbox controller startup path can enable

interrupt delivery before SCMI mailbox channel state has been published.

Similarly, smc_chan_setup() requests the optional A2P completion IRQ before

the SMC transport has made its cinfo pointer visible.

If a pending or spurious callback fires in those windows, the transport RX

callback can dereference a NULL transport cinfo pointer. Publishing only

the transport-private pointer is not sufficient either: an early callback

can enter the SCMI core before scmi_chan_setup() has assigned

cinfo->handle.

The core derives scmi_info from cinfo->handle in the RX path, so a NULL

handle can still fault even when the transport-private cinfo is valid.

Assign cinfo->handle be

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References