Bug 2536156 (CVE-2026-93089)

Summary:	CVE-2026-93089 kernel: firmware: arm_scmi: Free transport channel on IDR failure
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the `arm_scmi` firmware component of the Linux kernel. This vulnerability occurs when a transport channel setup succeeds but the subsequent IDR (ID allocator) insertion fails. In such a scenario, the error handling path incorrectly destroys the transport device and frees channel information without invoking the necessary transport cleanup callback. This oversight can lead to a resource leak, as transport-specific resources like Interrupt ReQuests (IRQs), mailbox channels, and mapped shared memory are not properly released.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-17 16:40:58 UTC

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_scmi: Free transport channel on IDR failure

If transport channel setup succeeds but the following IDR insertion fails,
the error path destroys the transport device and frees the channel info
without invoking the transport cleanup callback.

Call chan_free() before destroying the device so transport specific
resources such as IRQs, mailbox channels and mapped shared memory are
released consistently with the normal teardown path.

Comment 1 gkamathe 2026-09-19 03:09:15 UTC

Upstream advisory:
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93089.mbox