Bug 2532041 (CVE-2026-89512)

Summary:	CVE-2026-89512 kernel: remoteproc: scp: Fix device reference leak on failed lookup
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's remoteproc SCP component. This vulnerability involves a device reference leak, where the system fails to properly release a reference to a device during a driver data lookup. This occurs specifically before the driver has been fully bound. A local attacker could potentially exploit this issue to cause resource exhaustion, leading to a Denial of Service (DoS) condition.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-11 20:13:34 UTC

In the Linux kernel, the following vulnerability has been resolved:

remoteproc: scp: Fix device reference leak on failed lookup

Make sure to drop the reference taken to the SCP device when attempting
to look up its driver data before the driver has been bound.

Note that holding a reference to a device does not prevent its driver
data from going away.

Comment 1 Mauro Matteo Cascella 2026-09-14 15:07:36 UTC

Upstream advisory:
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89512.mbox