CVE-2026-93091

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory management issue exists in the arm scmi firmware component. The scmi notification exit() function releases the notification instance while transport callbacks may still deliver notifications before TX/RX channels are freed. This can lead to a use-after-free scenario where an RX interrupt triggers scmi notify() and dereferences freed memory during the removal process or on the probe error path. Additionally, a lifetime issue affects the late-init worker; because protocol event registration queues ni->init work on the system workqueue, destroying ni->notify wq fails to drain pending work. If the devres group is released while init work is pending or running, the worker may dereference the freed notification instance.

Recommendations Quiesce the notification core before tearing down TX/RX channels, then clean up the channels before releasing notification core resources. Use the disable work sync() function to ensure any queued or running late-init work is completed and future queueing is rejected before channel teardown begins.