---
id: CVE-2026-90397
title: >-
  In the Linux kernel, the following vulnerability has been resolved:


  firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is
  published


  In qcom_scm_probe(), devm_request_threaded_irq() is called before

  smp_store_release(…
summary: >-
  In the Linux kernel, the following vulnerability has been resolved:


  firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is
  published


  In qcom_scm_probe(), devm_request_threaded_irq() is called before

  smp_store_release(…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 6bf32599223634294cdc6efb359ffaab1d68073c <
    b451f38cb7f5bca78484362347f039c08c94de95
  - >-
    Linux >= 6bf32599223634294cdc6efb359ffaab1d68073c <
    1d753df5899ec356272d08bc4718e82844e4bdf0
  - >-
    Linux >= 6bf32599223634294cdc6efb359ffaab1d68073c <
    f312ef5026678f14caf1378c5f7fffdf667f9c81
  - >-
    Linux >= 6bf32599223634294cdc6efb359ffaab1d68073c <
    966d23c7e68ea32679275a7e3d2383181002c868
  - Linux 6.3
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:39.417'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90397'
references:
  - url: 'https://git.kernel.org/stable/c/1d753df5899ec356272d08bc4718e82844e4bdf0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/966d23c7e68ea32679275a7e3d2383181002c868'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b451f38cb7f5bca78484362347f039c08c94de95'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f312ef5026678f14caf1378c5f7fffdf667f9c81'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.801Z'
epss: 0.002
epssPercentile: 0.10124
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published

In qcom_scm_probe(), devm_request_threaded_irq() is called before
smp_store_release(&__scm, scm). Two paths can dereference __scm before
it is published, both causing a NULL pointer dereference.

The IRQ handler receives scm via its data argument but passes only wq_ctx
to qcom_scm_waitq_wakeup() and qcom_scm_get_completion(), which then
dereference __scm directly. Thread scm through both functions so the IRQ
handler path never touches __scm.

Non-atomic SMC calls made during probe (e.g. from qcom_tzmem_init via
qcom_scm_shm_bridge_enable) can return WAITQ_SLEEP, causing
qcom_scm_wait_for_wq_completion() to run before __scm is published and
dereference it. Add platform_set_drvdata(pdev, scm) early in probe and
change qcom_scm_wait_for_wq_completion() to take the device pointer and
use dev_get_drvdata() to reach scm, removing any dependency on __scm.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.