{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-93084","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-09-17T15:57:05.662Z","datePublished":"2026-09-17T16:11:03.659Z","dateUpdated":"2026-09-17T16:11:03.659Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-09-17T16:11:03.659Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Drop handle on protocol bind failures\n\nThe SCMI bus notifier acquires an SCMI handle when the driver core emits\nBUS_NOTIFY_BIND_DRIVER, before invoking the protocol driver probe\ncallback. The protocol probe path only checks whether sdev->handle is\nset.\n\nIf device_link_add() fails after the handle has been acquired, the\nprotocol device can still bind with a valid handle but without the\ndependency link to the SCMI parent. A concurrent parent unbind can then\nmiss the child and tear down the SCMI instance while the child still\nholds a handle into it.\n\nIf the protocol driver probe later fails, for example with\n-EPROBE_DEFER, the driver core emits BUS_NOTIFY_DRIVER_NOT_BOUND rather\nthan BUS_NOTIFY_UNBOUND_DRIVER. The SCMI notifier only released the\nhandle on BUS_NOTIFY_UNBOUND_DRIVER, so each failed protocol-device bind\nleaked the SCMI instance users refcount and left sdev->handle set after\nthe failed probe.\n\nMake the link helper report failure and drop the acquired handle if the\nlink cannot be created. Also handle BUS_NOTIFY_DRIVER_NOT_BOUND in the\nsame cleanup path used for unbind so failed probes balance the earlier\nBUS_NOTIFY_BIND_DRIVER acquisition."}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/firmware/arm_scmi/driver.c"],"versions":[{"version":"971fc0665f1361f23251e4d85fac4aed1b683505","lessThan":"0f860db24ee95e5da4866303a35e55098b9641b3","status":"affected","versionType":"git"},{"version":"971fc0665f1361f23251e4d85fac4aed1b683505","lessThan":"df273eced7cec550465fd1bb82a5d2c3c7d3c437","status":"affected","versionType":"git"},{"version":"971fc0665f1361f23251e4d85fac4aed1b683505","lessThan":"a54dc23e8bd2246c28eafffa60b4634f0d1a11cc","status":"affected","versionType":"git"},{"version":"971fc0665f1361f23251e4d85fac4aed1b683505","lessThan":"77d2985d1e80e67f32026fc03e975c4c83cc543d","status":"affected","versionType":"git"},{"version":"971fc0665f1361f23251e4d85fac4aed1b683505","lessThan":"e3a5c30d233ca5d3e799a80da806554c703bda13","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/firmware/arm_scmi/driver.c"],"versions":[{"version":"6.3","status":"affected"},{"version":"0","lessThan":"6.3","status":"unaffected","versionType":"semver"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3-rc1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3","versionEndExcluding":"6.6.157"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3","versionEndExcluding":"6.12.110"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3","versionEndExcluding":"6.18.52"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3","versionEndExcluding":"7.2.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3","versionEndExcluding":"7.3-rc1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/0f860db24ee95e5da4866303a35e55098b9641b3"},{"url":"https://git.kernel.org/stable/c/df273eced7cec550465fd1bb82a5d2c3c7d3c437"},{"url":"https://git.kernel.org/stable/c/a54dc23e8bd2246c28eafffa60b4634f0d1a11cc"},{"url":"https://git.kernel.org/stable/c/77d2985d1e80e67f32026fc03e975c4c83cc543d"},{"url":"https://git.kernel.org/stable/c/e3a5c30d233ca5d3e799a80da806554c703bda13"}],"title":"firmware: arm_scmi: Drop handle on protocol bind failures","x_generator":{"engine":"bippy-1.2.0"}}}}