CVE-2026-93090 in Linux
Summary
by MITRE • 09/18/2026
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_scmi: Clean up channels on setup failure
scmi_channels_setup() can fail after the common BASE channel or earlier protocol channels have already been registered in the TX/RX IDRs.
Route this failure through the existing channel cleanup label so the transport channels, transport devices and IDR state created before the failure are released before the probe error path frees the SCMI instance ID.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/18/2026
The Linux kernel vulnerability identified within the ARM System Control and Management Interface (SCMI) subsystem represents a resource management flaw during driver initialization. The core issue resides in the scmi_channels_setup function, which is responsible for establishing communication channels between the host processor and the SCMI agent running on the firmware side. During this setup process, the kernel registers transport channels by allocating identifiers within Transmission/Reception Identifier Resource Descriptors (IDRs). If a failure occurs after these resources have been allocated but before the entire initialization sequence completes successfully, the system enters an error state where previously acquired resources are not properly released. This oversight leads to resource leaks that can degrade system stability over time or exhaust available identifier space, potentially preventing future devices from initializing correctly.
From a technical perspective, the flaw is categorized as improper cleanup of allocated resources upon failure paths, which aligns with CWE-401: Missing Release of Resource after Effective Lifetime. The specific mechanism involves the scmi_channels_setup function failing at various stages due to hardware unavailability, firmware errors, or configuration mismatches. When such a failure occurs post-registration in the TX/RX IDRs, the existing code path did not invoke the necessary cleanup routines for those channels and their associated transport devices. Instead, it proceeded directly to freeing the SCMI instance identifier without dismantling the intermediate structures that depend on them. This creates an inconsistent state where the kernel believes resources are still allocated while they may be orphaned or inaccessible, violating the principle of atomic resource acquisition and release.
The operational impact of this vulnerability is primarily related to system reliability and long-term stability rather than immediate security exploitation by external actors. Resource leaks in kernel space can lead to memory exhaustion or identifier depletion, which may cause subsequent device probes to fail even if the hardware is functional. In severe cases, repeated failures during boot or hotplug events could render the SCMI interface unusable for power management, performance scaling, and telemetry functions that rely on this protocol. While not a direct vector for privilege escalation or remote code execution, such instability can contribute to denial of service conditions by degrading system functionality over extended uptime periods or after multiple reconfiguration attempts.
Mitigation strategies involve applying the upstream kernel patch that corrects the control flow within scmi_channels_setup. The fix ensures that any failure occurring after channel registration routes through a dedicated cleanup label. This guarantees that transport channels, transport devices, and IDR state entries are properly released before the final probe error path frees the SCMI instance ID. Administrators should ensure their systems are updated to kernel versions containing this correction. Additionally, monitoring system logs for repeated SCMI initialization failures can help identify environments where resource exhaustion might be occurring due to unpatched instances of this flaw. Regular auditing of driver load and unload cycles in production environments serves as a secondary defense against the accumulation of such resource leaks.