CVE-2026-93091

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_scmi: Quiesce notifications before teardown

scmi_notification_exit() clears and releases the notification instance,

but transport callbacks can still deliver incoming notifications until

the TX/RX channels are freed. During remove, an RX interrupt in that

window can enter scmi_notify() while notification state is being torn

down and then dereference freed memory. The same ordering exists on the

probe error path after notification initialization.

The notification late-init worker has a separate lifetime issue: protocol

event registration queues ni->init_work on the system workqueue, so

destroying ni->notify_wq does not drain that work. If the devres group is

released while init_work is still pending or running, the late-init worker

can dereference the freed notification instance.

Quiesce the notification core before TX/RX channels are torn down, then

clean up the channels before releasing the notificat

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References