---
id: CVE-2026-93086
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  firmware: arm_scmi: Avoid IDR updates while cleaning channels

  scmi_cleanup_channels() walks the TX/RX channel IDRs with
  idr_for_each() to free transport resources and …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  firmware: arm_scmi: Avoid IDR updates while cleaning channels

  scmi_cleanup_channels() walks the TX/RX channel IDRs with
  idr_for_each() to free transport resources and …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 05a2801d8b90c1b5159618d4bd3a3c65d60f3ff1 <
    aed24a3c63920539e9de7fbfe7929a2e7c888cd2
  - >-
    Linux >= 05a2801d8b90c1b5159618d4bd3a3c65d60f3ff1 <
    431c6b872ba7fedcc5a3afb0ec3517db4d95d088
  - >-
    Linux >= 05a2801d8b90c1b5159618d4bd3a3c65d60f3ff1 <
    54e5a4f7d83db4552d963d0785be32d9df680dcd
  - >-
    Linux >= 05a2801d8b90c1b5159618d4bd3a3c65d60f3ff1 <
    bab26acebe55e8ad3ab545abda72faa7ca28c477
  - >-
    Linux >= 05a2801d8b90c1b5159618d4bd3a3c65d60f3ff1 <
    c38b1e19485aaa820e52cfe162525a8af67563da
  - Linux 6.3
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:18:02.713'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93086'
references:
  - url: 'https://git.kernel.org/stable/c/431c6b872ba7fedcc5a3afb0ec3517db4d95d088'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/54e5a4f7d83db4552d963d0785be32d9df680dcd'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/aed24a3c63920539e9de7fbfe7929a2e7c888cd2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/bab26acebe55e8ad3ab545abda72faa7ca28c477'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c38b1e19485aaa820e52cfe162525a8af67563da'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.760Z'
epss: 0.002
epssPercentile: 0.1011
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_scmi: Avoid IDR updates while cleaning channels

scmi_cleanup_channels() walks the TX/RX channel IDRs with
idr_for_each() to free transport resources and destroy the dedicated
transport devices before calling idr_destroy().

The destroy callback removed each entry from the same IDR being walked.
That is not needed for this cleanup path, and it is unsafe because
idr_for_each() has not advanced its radix-tree iterator while the
callback is running. Removing the current entry from the callback can
invalidate the iterator state. The callback also cannot be protected by
rcu_read_lock(), because scmi_device_destroy() may sleep.

Leave IDR teardown to the following idr_destroy() call and keep the
callback limited to device destruction.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.