{"id":"CVE-2026-93091","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Quiesce notifications before teardown\n\nscmi_notification_exit() clears and releases the notification instance,\nbut transport callbacks can still del…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Quiesce notifications before teardown\n\nscmi_notification_exit() clears and releases the notification instance,\nbut transport callbacks can still del…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 1e7cbfaa66d39e78bd24df0c78b55df68176b59e < 6778bcabd2e0c32f73476f0bc6369013692540be","Linux >= 1e7cbfaa66d39e78bd24df0c78b55df68176b59e < 2aac23bc0a79af41104d99823bb250fae92ba144","Linux >= 1e7cbfaa66d39e78bd24df0c78b55df68176b59e < 5e30d3d16d1a9e599be4dcea872874e65e2c277b","Linux >= 1e7cbfaa66d39e78bd24df0c78b55df68176b59e < 8e49055d0d495c9c07575ad8e111d9eaf0efb13f","Linux 5.15"],"published":"2026-09-17","updated":"2026-09-17","sourceUpdated":"2026-09-17T17:18:03.063","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93091","references":[{"url":"https://git.kernel.org/stable/c/2aac23bc0a79af41104d99823bb250fae92ba144","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5e30d3d16d1a9e599be4dcea872874e65e2c277b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6778bcabd2e0c32f73476f0bc6369013692540be","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8e49055d0d495c9c07575ad8e111d9eaf0efb13f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-17T16:21:47.760Z","epss":0.00168,"epssPercentile":0.06478,"slug":"CVE-2026-93091","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Quiesce notifications before teardown\n\nscmi_notification_exit() clears and releases the notification instance,\nbut transport callbacks can still deliver incoming notifications until\nthe TX/RX channels are freed. During remove, an RX interrupt in that\nwindow can enter scmi_notify() while notification state is being torn\ndown and then dereference freed memory. The same ordering exists on the\nprobe error path after notification initialization.\n\nThe notification late-init worker has a separate lifetime issue: protocol\nevent registration queues ni->init_work on the system workqueue, so\ndestroying ni->notify_wq does not drain that work. If the devres group is\nreleased while init_work is still pending or running, the late-init worker\ncan dereference the freed notification instance.\n\nQuiesce the notification core before TX/RX channels are torn down, then\nclean up the channels before releasing the notification core resources.\nUse disable_work_sync() so future late-init queueing is rejected and any\nalready queued or running late-init work has completed before channel\nteardown starts.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}