{"id":"CVE-2026-93084","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Drop handle on protocol bind failures\n\nThe SCMI bus notifier acquires an SCMI handle when the driver core emits\nBUS_NOTIFY_BIND_DRIVER, before invok…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Drop handle on protocol bind failures\n\nThe SCMI bus notifier acquires an SCMI handle when the driver core emits\nBUS_NOTIFY_BIND_DRIVER, before invok…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 971fc0665f1361f23251e4d85fac4aed1b683505 < 0f860db24ee95e5da4866303a35e55098b9641b3","Linux >= 971fc0665f1361f23251e4d85fac4aed1b683505 < df273eced7cec550465fd1bb82a5d2c3c7d3c437","Linux >= 971fc0665f1361f23251e4d85fac4aed1b683505 < a54dc23e8bd2246c28eafffa60b4634f0d1a11cc","Linux >= 971fc0665f1361f23251e4d85fac4aed1b683505 < 77d2985d1e80e67f32026fc03e975c4c83cc543d","Linux >= 971fc0665f1361f23251e4d85fac4aed1b683505 < e3a5c30d233ca5d3e799a80da806554c703bda13","Linux 6.3"],"published":"2026-09-17","updated":"2026-09-17","sourceUpdated":"2026-09-17T17:18:02.460","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93084","references":[{"url":"https://git.kernel.org/stable/c/0f860db24ee95e5da4866303a35e55098b9641b3","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/77d2985d1e80e67f32026fc03e975c4c83cc543d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a54dc23e8bd2246c28eafffa60b4634f0d1a11cc","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/df273eced7cec550465fd1bb82a5d2c3c7d3c437","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e3a5c30d233ca5d3e799a80da806554c703bda13","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-17T16:21:47.761Z","epss":0.00168,"epssPercentile":0.06481,"slug":"CVE-2026-93084","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Drop handle on protocol bind failures\n\nThe SCMI bus notifier acquires an SCMI handle when the driver core emits\nBUS_NOTIFY_BIND_DRIVER, before invoking the protocol driver probe\ncallback. The protocol probe path only checks whether sdev->handle is\nset.\n\nIf device_link_add() fails after the handle has been acquired, the\nprotocol device can still bind with a valid handle but without the\ndependency link to the SCMI parent. A concurrent parent unbind can then\nmiss the child and tear down the SCMI instance while the child still\nholds a handle into it.\n\nIf the protocol driver probe later fails, for example with\n-EPROBE_DEFER, the driver core emits BUS_NOTIFY_DRIVER_NOT_BOUND rather\nthan BUS_NOTIFY_UNBOUND_DRIVER. The SCMI notifier only released the\nhandle on BUS_NOTIFY_UNBOUND_DRIVER, so each failed protocol-device bind\nleaked the SCMI instance users refcount and left sdev->handle set after\nthe failed probe.\n\nMake the link helper report failure and drop the acquired handle if the\nlink cannot be created. Also handle BUS_NOTIFY_DRIVER_NOT_BOUND in the\nsame cleanup path used for unbind so failed probes balance the earlier\nBUS_NOTIFY_BIND_DRIVER acquisition.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}