{"id":"CVE-2026-93084","state":"PUBLISHED","title":"firmware: arm_scmi: Drop handle on protocol bind failures","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Drop handle on protocol bind failures\n\nThe SCMI bus notifier acquires an SCMI handle when the driver core emits\nBUS_NOTIFY_BIND_DRIVER, before invoking the protocol driver probe\ncallback. The protocol probe path only checks whether sdev->handle is\nset.\n\nIf device_link_add() fails after the handle has been acquired, the\nprotocol device can still bind with a valid handle but without the\ndependency link to the SCMI parent. A concurrent parent unbind can then\nmiss the child and tear down the SCMI instance while the child still\nholds a handle into it.\n\nIf the protocol driver probe later fails, for example with\n-EPROBE_DEFER, the driver core emits BUS_NOTIFY_DRIVER_NOT_BOUND rather\nthan BUS_NOTIFY_UNBOUND_DRIVER. The SCMI notifier only released the\nhandle on BUS_NOTIFY_UNBOUND_DRIVER, so each failed protocol-device bind\nleaked the SCMI instance users refcount and left sdev->handle set after\nthe failed probe.\n\nMake the link helper report failure and drop the acquired handle if the\nlink cannot be created. Also handle BUS_NOTIFY_DRIVER_NOT_BOUND in the\nsame cleanup path used for unbind so failed probes balance the earlier\nBUS_NOTIFY_BIND_DRIVER acquisition.","publishedAt":"2026-09-17T16:11:03.659Z","updatedAt":"2026-10-30T12:35:50.721Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"b50c9270304cfed6ee1c4ce5036102ad7b762051","status":"affected","lessThan":"b5377e690cd4fe87ee52fcf067c9929414ea8f4e","versionType":"git"},{"version":"971fc0665f1361f23251e4d85fac4aed1b683505","status":"affected","lessThan":"0f860db24ee95e5da4866303a35e55098b9641b3","versionType":"git"},{"version":"971fc0665f1361f23251e4d85fac4aed1b683505","status":"affected","lessThan":"df273eced7cec550465fd1bb82a5d2c3c7d3c437","versionType":"git"},{"version":"971fc0665f1361f23251e4d85fac4aed1b683505","status":"affected","lessThan":"a54dc23e8bd2246c28eafffa60b4634f0d1a11cc","versionType":"git"},{"version":"971fc0665f1361f23251e4d85fac4aed1b683505","status":"affected","lessThan":"77d2985d1e80e67f32026fc03e975c4c83cc543d","versionType":"git"},{"version":"971fc0665f1361f23251e4d85fac4aed1b683505","status":"affected","lessThan":"e3a5c30d233ca5d3e799a80da806554c703bda13","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/firmware/arm_scmi/driver.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.3","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.3","versionType":"semver"},{"version":"6.6.157","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.110","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.52","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.6","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/firmware/arm_scmi/driver.c"]}],"references":["https://git.kernel.org/stable/c/b5377e690cd4fe87ee52fcf067c9929414ea8f4e","https://git.kernel.org/stable/c/0f860db24ee95e5da4866303a35e55098b9641b3","https://git.kernel.org/stable/c/df273eced7cec550465fd1bb82a5d2c3c7d3c437","https://git.kernel.org/stable/c/a54dc23e8bd2246c28eafffa60b4634f0d1a11cc","https://git.kernel.org/stable/c/77d2985d1e80e67f32026fc03e975c4c83cc543d","https://git.kernel.org/stable/c/e3a5c30d233ca5d3e799a80da806554c703bda13"],"weaknesses":[],"ingestedAt":"2026-10-30T12:54:04.478Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/93xxx/CVE-2026-93084.json","commit":"1f312381e38164a43607eebab851b151dd16861e","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-93084","state":"PUBLISHED","datePublished":"2026-09-17T16:11:03.659Z","dateUpdated":"2026-10-30T12:35:50.721Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-17T15:57:05.662Z"},"containers":{"cna":{"title":"firmware: arm_scmi: Drop handle on protocol bind failures","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Drop handle on protocol bind failures\n\nThe SCMI bus notifier acquires an SCMI handle when the driver core emits\nBUS_NOTIFY_BIND_DRIVER, before invoking the protocol driver probe\ncallback. The protocol probe path only checks whether sdev->handle is\nset.\n\nIf device_link_add() fails after the handle has been acquired, the\nprotocol device can still bind with a valid handle but without the\ndependency link to the SCMI parent. A concurrent parent unbind can then\nmiss the child and tear down the SCMI instance while the child still\nholds a handle into it.\n\nIf the protocol driver probe later fails, for example with\n-EPROBE_DEFER, the driver core emits BUS_NOTIFY_DRIVER_NOT_BOUND rather\nthan BUS_NOTIFY_UNBOUND_DRIVER. The SCMI notifier only released the\nhandle on BUS_NOTIFY_UNBOUND_DRIVER, so each failed protocol-device bind\nleaked the SCMI instance users refcount and left sdev->handle set after\nthe failed probe.\n\nMake the link helper report failure and drop the acquired handle if the\nlink cannot be created. Also handle BUS_NOTIFY_DRIVER_NOT_BOUND in the\nsame cleanup path used for unbind so failed probes balance the earlier\nBUS_NOTIFY_BIND_DRIVER acquisition."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"b50c9270304cfed6ee1c4ce5036102ad7b762051","status":"affected","lessThan":"b5377e690cd4fe87ee52fcf067c9929414ea8f4e","versionType":"git"},{"version":"971fc0665f1361f23251e4d85fac4aed1b683505","status":"affected","lessThan":"0f860db24ee95e5da4866303a35e55098b9641b3","versionType":"git"},{"version":"971fc0665f1361f23251e4d85fac4aed1b683505","status":"affected","lessThan":"df273eced7cec550465fd1bb82a5d2c3c7d3c437","versionType":"git"},{"version":"971fc0665f1361f23251e4d85fac4aed1b683505","status":"affected","lessThan":"a54dc23e8bd2246c28eafffa60b4634f0d1a11cc","versionType":"git"},{"version":"971fc0665f1361f23251e4d85fac4aed1b683505","status":"affected","lessThan":"77d2985d1e80e67f32026fc03e975c4c83cc543d","versionType":"git"},{"version":"971fc0665f1361f23251e4d85fac4aed1b683505","status":"affected","lessThan":"e3a5c30d233ca5d3e799a80da806554c703bda13","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/firmware/arm_scmi/driver.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.3","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.3","versionType":"semver"},{"version":"6.6.157","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.110","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.52","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.6","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/firmware/arm_scmi/driver.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/b5377e690cd4fe87ee52fcf067c9929414ea8f4e"},{"url":"https://git.kernel.org/stable/c/0f860db24ee95e5da4866303a35e55098b9641b3"},{"url":"https://git.kernel.org/stable/c/df273eced7cec550465fd1bb82a5d2c3c7d3c437"},{"url":"https://git.kernel.org/stable/c/a54dc23e8bd2246c28eafffa60b4634f0d1a11cc"},{"url":"https://git.kernel.org/stable/c/77d2985d1e80e67f32026fc03e975c4c83cc543d"},{"url":"https://git.kernel.org/stable/c/e3a5c30d233ca5d3e799a80da806554c703bda13"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:35:50.721Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3","versionEndExcluding":"6.6.157"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3","versionEndExcluding":"6.12.110"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3","versionEndExcluding":"6.18.52"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3","versionEndExcluding":"7.2.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}