CVE-2024-26893

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_scmi: Fix double free in SMC transport cleanup path

When the generic SCMI code tears down a channel, it calls the chan_free

callback function, defined by each transport. Since multiple protocols

might share the same transport_info member, chan_free() might want to

clean up the same member multiple times within the given SCMI transport

implementation. In this case, it is SMC transport. This will lead to a NULL

pointer dereference at the second time:

| scmi_protocol scmi_dev.1: Enabled polling mode TX channel - prot_id:16

| arm-scmi firmware:scmi: SCMI Notifications - Core Enabled.

| arm-scmi firmware:scmi: unable to communicate with SCMI

| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000

| Mem abort info:

| ESR = 0x0000000096000004

| EC = 0x25: DABT (current EL), IL = 32 bits

| SET = 0, FnV = 0

| EA = 0, S1PTW = 0

| FS

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References