CVE-2026-93089 in Linux
Summary
by MITRE • 09/18/2026
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_scmi: Free transport channel on IDR failure
If transport channel setup succeeds but the following IDR insertion fails, the error path destroys the transport device and frees the channel info without invoking the transport cleanup callback.
Call chan_free() before destroying the device so transport specific resources such as IRQs, mailbox channels and mapped shared memory are released consistently with the normal teardown path.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The Linux kernel's System Control and Management Interface (SCMI) subsystem manages communication between a host processor and system controllers for power management, clock control, and other hardware configuration tasks. A critical resource management flaw was identified in the transport channel initialization logic within the arm_scmi driver. This vulnerability arises during the setup phase where the driver attempts to allocate and register a transport channel using an Identifier Resource (IDR) mechanism. The IDR is used to assign unique identifiers to channels for efficient lookup and management. When the initial allocation of the transport structure succeeds, but the subsequent insertion into the IDR fails due to resource exhaustion or other errors, the kernel enters an error handling path that incorrectly manages cleanup operations.
The core technical flaw lies in the order and completeness of the teardown sequence during this failure scenario. The original code path destroyed the underlying transport device and freed the channel information structure without invoking the specific transport layer's cleanup callback function. This omission means that resources allocated by the specific transport implementation, such as interrupt requests (IRQs), mailbox channels used for inter-processor communication, and mapped shared memory regions required for data exchange between the host and the remote processor, were not released properly. These resources remained leaked or in an undefined state because the specialized cleanup routine responsible for releasing them was bypassed during this specific error condition.
This oversight leads to resource leaks that can accumulate over time if the failure condition is triggered repeatedly, potentially leading to system instability or denial of service as available kernel memory and hardware interrupt lines are exhausted. Furthermore, leaving shared memory mapped or IRQs active when they should be disabled poses a security risk by allowing potential unauthorized access to sensitive data structures or causing unintended side effects in other parts of the firmware stack that might still reference these dangling resources. The vulnerability is classified under CWE-401, which describes missing release of memory after successful allocation, and aligns with ATT&CK technique T1539 regarding Steal Web Session Cookie if it impacts session state management through resource exhaustion, though primarily it represents a local denial-of-service vector via kernel resource depletion.
The resolution involves modifying the error handling path to ensure that chan_free is called before the transport device is destroyed. This ensures that all transport-specific resources are released consistently with the normal teardown path used during successful operation and graceful shutdowns. By invoking the appropriate cleanup callback, the driver guarantees that IRQs are disabled and freed, mailbox channels are closed, and shared memory mappings are unmapped. This fix restores consistency to the resource lifecycle management within the SCMI subsystem, preventing leaks and ensuring system stability under error conditions.
To mitigate this vulnerability in environments where patching is not immediately possible, administrators should monitor kernel logs for allocation failures related to firmware transport layers and consider implementing strict limits on concurrent channel allocations if feasible at the application level. However, the definitive mitigation requires applying the upstream Linux kernel patch that corrects the teardown sequence in the arm_scmi driver. Regular system updates are essential to maintain the integrity of hardware abstraction layers and prevent resource exhaustion attacks that exploit such low-level memory management flaws.