CVE-2026-93085 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_scmi: Reject out of range DT protocol IDs
SCMI protocol IDs carried in message headers are limited by MSG_PROTOCOL_ID_MASK. The DT parsing paths noticed protocol IDs outside that range, but only logged an error and then kept processing the invalid value.
That lets a malformed 32-bit DT reg value reach helpers which take a u8 protocol ID, where it can be truncated and/or treated as a different protocol.
For channel setup, two different out-of-range values can also be used as distinct IDR keys while aliasing the generated SCMI protocol identity.
Skip DT protocol nodes whose reg value does not fit the SCMI protocol ID field before setting up channels or creating protocol devices.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The Linux kernel firmware subsystem for ARM System Control and Management Interface, known as arm_scmi, contained a critical input validation flaw related to Device Tree parsing. The SCMI specification defines strict limits on protocol identifiers carried within message headers, constrained by the MSG_PROTOCOL_ID_MASK constant which typically restricts valid IDs to an eight-bit range. However, the initial device tree parsing logic failed to enforce this boundary check effectively during the early stages of initialization. While the code did detect when a protocol ID exceeded the allowed range and logged an error message, it erroneously continued processing with the invalid value rather than aborting or rejecting the node entirely. This oversight represents a significant deviation from secure coding practices where input validation must be strict and fail-safe to prevent downstream exploitation or system instability.
The operational impact of this vulnerability stems directly from type truncation and improper data handling in subsequent helper functions that expect an unsigned eight-bit integer for protocol identification. When a malformed thirty-two-bit device tree register value is passed through the unchecked parsing path, it undergoes implicit narrowing conversion. This process can truncate high-order bits or map multiple distinct out-of-range values to the same lower-eight-bit representation. Consequently, different physical protocols may be aliased under a single logical identity within the kernel's internal data structures. This aliasing creates confusion in protocol management layers, potentially leading to incorrect command routing where messages intended for one hardware subsystem are misdirected or processed by another unrelated component that shares the truncated identifier.
Furthermore, this flaw introduces risks during channel setup and resource allocation phases of the SCMI driver implementation. The kernel utilizes an IDR (ID Radix Tree) mechanism to manage protocol instances, assigning unique keys to each active protocol device. Because the validation was bypassed for out-of-range values, malicious or malformed configuration data could cause two distinct invalid identifiers to map to the same internal key within the IDR structure. This collision compromises the integrity of resource tracking and can lead to race conditions, memory corruption, or undefined behavior when the kernel attempts to manage channels associated with these aliased protocol identities. The lack of early rejection allows corrupted state to propagate into core subsystems that rely on accurate one-to-one mappings between device tree nodes and runtime protocol instances.
From a vulnerability classification perspective, this issue aligns closely with CWE-20 Improper Input Validation and CWE-197 Numeric Truncation Error. The failure to validate the upper bounds of an integer field before use constitutes improper input validation, while the subsequent truncation into a smaller data type exemplifies numeric truncation. In terms of attack vectors, this could be leveraged in scenarios where attackers have control over device tree configurations or firmware images loaded at boot time, potentially falling under CWE-94 Improper Control of Generation of Code (Code Injection) if the truncated ID leads to execution flow manipulation, though primarily it serves as a stability and integrity risk. It does not directly map to ATT&CK techniques unless combined with other vulnerabilities that allow arbitrary code execution via the misrouted commands.
To mitigate this vulnerability, developers must implement strict boundary checks immediately upon parsing device tree properties for SCMI protocol IDs. The logic should verify that any extracted register value fits within the MSG_PROTOCOL_ID_MASK constraints before proceeding to channel setup or protocol device creation. If a value falls outside the acceptable range, the system should reject the node and prevent further initialization of that specific protocol instance. This ensures that only valid, well-formed identifiers are passed to helper functions expecting eight-bit integers, thereby eliminating the risk of truncation-induced aliasing and IDR key collisions. Such hardening measures reinforce the principle of least privilege by ensuring that kernel subsystems operate exclusively with verified inputs, maintaining system stability and preventing potential exploitation paths arising from malformed configuration data.