EUVD-2026-82200

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Unregister device notifier before IDR teardown The requested-devices notifier looks up protocol fwnodes from the activeprotocols IDR. During remove, unregister the notifier before releasing and destroying...

EUVD-2026-82199

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Quiesce notifications before teardown scminotificationexit clears and releases the notification instance, but transport callbacks can still deliver incoming notifications until the TX/RX channels are freed...

CVE-2026-93091 firmware: arm_scmi: Quiesce notifications before teardown

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Quiesce notifications before teardown scminotificationexit clears and releases the notification instance, but transport callbacks can still deliver incoming notifications until the TX/RX channels are freed...

CVE-2026-93090 firmware: arm_scmi: Clean up channels on setup failure

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Clean up channels on setup failure scmichannelssetup can fail after the common BASE channel or earlier protocol channels have already been registered in the TX/RX IDRs. Route this failure through the existing...

CVE-2026-93090

CVE-2026-93090 affects the ARM SCMI (System Control and Management Interface) firmware driver in the Linux kernel . The root cause is a failure-handling defect in scmi_channels_setup(): if this function fails after the common BASE channel or earlier protocol channels have already been registered ...

EUVD-2026-82198

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Clean up channels on setup failure scmichannelssetup can fail after the common BASE channel or earlier protocol channels have already been registered in the TX/RX IDRs. Route this failure through the existing...

CVE-2026-93090 firmware: arm_scmi: Clean up channels on setup failure

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Clean up channels on setup failure scmichannelssetup can fail after the common BASE channel or earlier protocol channels have already been registered in the TX/RX IDRs. Route this failure through the existing...

CVE-2026-93086 firmware: arm_scmi: Avoid IDR updates while cleaning channels

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Avoid IDR updates while cleaning channels scmicleanupchannels walks the TX/RX channel IDRs with idrforeach to free transport resources and destroy the dedicated transport devices before calling idrdestroy. The...

EUVD-2026-82196

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Avoid IDR updates while cleaning channels scmicleanupchannels walks the TX/RX channel IDRs with idrforeach to free transport resources and destroy the dedicated transport devices before calling idrdestroy. The...

CVE-2026-93089

In the Linux kernel , the firmware: arm_scmi driver contains a resource-leak vulnerability in its error handling path. When the transport channel setup succeeds but the subsequent IDR insertion fails, the error path destroys the transport device and frees the channel info without invoking the tra...

CVE-2026-93089 firmware: arm_scmi: Free transport channel on IDR failure

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Free transport channel on IDR failure If transport channel setup succeeds but the following IDR insertion fails, the error path destroys the transport device and frees the channel info without invoking the...

CVE-2026-93086

CVE-2026-93086 affects the Linux kernel's arm_scmi firmware driver. The vulnerability resides in scmi_cleanup_channels(), which iterates over TX/RX channel IDRs using idr_for_each() to free transport resources. The destroy callback incorrectly removed each entry from the IDR being walked, which c...

CVE-2026-93086 firmware: arm_scmi: Avoid IDR updates while cleaning channels

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Avoid IDR updates while cleaning channels scmicleanupchannels walks the TX/RX channel IDRs with idrforeach to free transport resources and destroy the dedicated transport devices before calling idrdestroy. The...

EUVD-2026-82197

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Free transport channel on IDR failure If transport channel setup succeeds but the following IDR insertion fails, the error path destroys the transport device and frees the channel info without invoking the...

CVE-2026-93089 firmware: arm_scmi: Free transport channel on IDR failure

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Free transport channel on IDR failure If transport channel setup succeeds but the following IDR insertion fails, the error path destroys the transport device and frees the channel info without invoking the...

CVE-2026-93085

CVE-2026-93085 affects the Linux kernel arm_scmi firmware driver . The Device Tree parsing paths accepted SCMI protocol IDs outside the valid range defined by MSG_PROTOCOL_ID_MASK , logging an error but continuing to process the invalid value. A malformed 32-bit DT reg value could reach helpers e...

EUVD-2026-82195

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Reject out of range DT protocol IDs SCMI protocol IDs carried in message headers are limited by MSGPROTOCOLIDMASK. The DT parsing paths noticed protocol IDs outside that range, but only logged an error and then...

CVE-2026-93085 firmware: arm_scmi: Reject out of range DT protocol IDs

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Reject out of range DT protocol IDs SCMI protocol IDs carried in message headers are limited by MSGPROTOCOLIDMASK. The DT parsing paths noticed protocol IDs outside that range, but only logged an error and then...

CVE-2026-93085 firmware: arm_scmi: Reject out of range DT protocol IDs

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Reject out of range DT protocol IDs SCMI protocol IDs carried in message headers are limited by MSGPROTOCOLIDMASK. The DT parsing paths noticed protocol IDs outside that range, but only logged an error and then...

CVE-2026-93084 firmware: arm_scmi: Drop handle on protocol bind failures

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Drop handle on protocol bind failures The SCMI bus notifier acquires an SCMI handle when the driver core emits BUSNOTIFYBINDDRIVER, before invoking the protocol driver probe callback. The protocol probe path on...