CVE-2026-90397

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference occurs in the qcom SCM driver during the probe process. In qcom scm probe(), the function devm request threaded irq() is called before the scm variable is published via smp store release(). This creates two problematic paths: the IRQ handler calls qcom scm waitq wakeup() and qcom scm get completion(), both of which dereference scm directly. Additionally, non-atomic SMC calls during probe, such as those from qcom tzmem init via qcom scm shm bridge enable, can trigger qcom scm wait for wq completion(), which also dereferences scm before it is published.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.