CVE-2026-93091: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Quiesce notifications before teardown scminotificationexit clears and releases the notification instance, but transport callbacks can still deliver incoming notifications until the TX/RX channels are freed...

CVE-2026-93092: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Unregister device notifier before IDR teardown The requested-devices notifier looks up protocol fwnodes from the activeprotocols IDR. During remove, unregister the notifier before releasing and destroying...

CVE-2026-93085: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Reject out of range DT protocol IDs SCMI protocol IDs carried in message headers are limited by MSGPROTOCOLIDMASK. The DT parsing paths noticed protocol IDs outside that range, but only logged an error and then...

CVE-2026-93082: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Unwind P2A receiver mailbox setup failure mailboxchansetup can request an additional P2A receiver channel after successfully acquiring the primary P2A channel. If that later request fails, the function returns...

CVE-2026-93083: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Unwind TX receiver mailbox setup failure mailboxchansetup can request an additional unidirectional TX receiver channel after successfully acquiring the primary channel. If that second request fails, the functio...

CVE-2026-93081: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Fix SCMI device destroy lifetimes scmichilddevfind drops the reference returned by devicefindchild before returning the scmidevice pointer. A concurrent unregister can then release the device while the destroy...

CVE-2026-93086: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Avoid IDR updates while cleaning channels scmicleanupchannels walks the TX/RX channel IDRs with idrforeach to free transport resources and destroy the dedicated transport devices before calling idrdestroy. The...

CVE-2024-53068 firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier()

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Fix slab-use-after-free in scmibusnotifier The scmidev-name is released prematurely in scmidevicedestroy, which causes slab-use-after-free when accessing scmidev-name in scmibusnotifier. So move the release of...

CVE-2024-49853 firmware: arm_scmi: Fix double free in OPTEE transport

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Fix double free in OPTEE transport Channels can be shared between protocols, avoid freeing the same channel descriptors twice when unloading the stack...

CVE-2022-48655

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Harden accesses to the reset domains Accessing reset domains descriptors by the index upon the SCMI drivers requests through the SCMI reset operations interface can potentially lead to out-of-bound violations i...

CVE-2022-48655

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Harden accesses to the reset domains Accessing reset domains descriptors by the index upon the SCMI drivers requests through the SCMI reset operations interface can potentially lead to out-of-bound violations i...

Race condition

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Check mailbox/SMT channel for consistency On reception of a completion interrupt the shared memory area is accessed to retrieve the message header at first and then, if the message sequence number identifies a...

GSD-2022-1003067 firmware: arm_scmi: Fix list protocols enumeration in the base protocol

firmware: armscmi: Fix list protocols enumeration in the base protocol This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.14 by commit...