---
id: CVE-2026-92491
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  firmware: arm_scmi: Roll back partial protocol table registration

  scmi_protocol_table_register() can leave earlier requests registered when
  a later entry in the same I…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  firmware: arm_scmi: Roll back partial protocol table registration

  scmi_protocol_table_register() can leave earlier requests registered when
  a later entry in the same I…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 41714150f3d148fbcd7a947869c85531b53c50d4 <
    ee556d118b11c6f5b60a32c1e84f366b336ac7d7
  - >-
    Linux >= 2858f6e5f06440d6b9e9c3f57bc68915344830a9 <
    3fa8cabd2d8ed80dd0b818ca7fd410b591392ff6
  - >-
    Linux >= 2858f6e5f06440d6b9e9c3f57bc68915344830a9 <
    456856a34906475fcf4b23879237103770dc7ef2
  - >-
    Linux >= 2858f6e5f06440d6b9e9c3f57bc68915344830a9 <
    826413b858ea2969e4c3e8197d0065efc47c6343
  - >-
    Linux >= 2858f6e5f06440d6b9e9c3f57bc68915344830a9 <
    2224b622260ba590ab56ea1585d6bf7610be25b2
  - Linux 6.9
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:51.233'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92491'
references:
  - url: 'https://git.kernel.org/stable/c/2224b622260ba590ab56ea1585d6bf7610be25b2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3fa8cabd2d8ed80dd0b818ca7fd410b591392ff6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/456856a34906475fcf4b23879237103770dc7ef2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/826413b858ea2969e4c3e8197d0065efc47c6343'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ee556d118b11c6f5b60a32c1e84f366b336ac7d7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.785Z'
epss: 0.00209
epssPercentile: 0.09738
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_scmi: Roll back partial protocol table registration

scmi_protocol_table_register() can leave earlier requests registered when
a later entry in the same ID table fails. Each request retains a pointer
to the driver's ID table, so a failed module load can leave a dangling
pointer after the module storage is released.

Unrequest only the successfully registered prefix, in reverse order,
before returning the failure. Leave the failed entry and the remaining
entries untouched because matching requests can be owned by another
driver.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.