« Volver al listado

CVE-2026-92506

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_scmi: Fix requested device removal race

scmi_protocol_device_unrequest() drops scmi_requested_devices_mtx while notifying listeners but continues to retain the per-protocol list head. When two SCMI drivers for the same protocol unregister concurrently, one thread can remove the final request and free the list head while the other is running its notifier. The latter then dereferences the freed list head after reacquiring the mutex and can free it a second time.

Complete the list and IDR updates, including freeing an empty list head, before dropping the mutex. Keep the blocking notifier outside the critical section and retain only the detached request across the callback.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-92506",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "d3cd7c525fd2ecce3a6c963f314969a54783d211",
              "lessThan": "2ff7713b7308cd6bea3328f7cd750b5eaab42af3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d3cd7c525fd2ecce3a6c963f314969a54783d211",
              "lessThan": "1c35915eaaa81a12340c838c5c2ccb02be2194c3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d3cd7c525fd2ecce3a6c963f314969a54783d211",
              "lessThan": "c3d4ef1c0ca6917aad6f1093b49f3932944a8c19",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d3cd7c525fd2ecce3a6c963f314969a54783d211",
              "lessThan": "21d35c5f46e99e9047bb9ded3ecb5ab440dd75b3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d3cd7c525fd2ecce3a6c963f314969a54783d211",
              "lessThan": "2c4097e6c4aed276c5e9ec2ab331ab397ea780bf",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/firmware/arm_scmi/bus.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.3",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/firmware/arm_scmi/bus.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-17T17:17:53.187",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/1c35915eaaa81a12340c838c5c2ccb02be2194c3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/21d35c5f46e99e9047bb9ded3ecb5ab440dd75b3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/2c4097e6c4aed276c5e9ec2ab331ab397ea780bf",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/2ff7713b7308cd6bea3328f7cd750b5eaab42af3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c3d4ef1c0ca6917aad6f1093b49f3932944a8c19",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Fix requested device removal race\n\nscmi_protocol_device_unrequest() drops scmi_requested_devices_mtx while\nnotifying listeners but continues to retain the per-protocol list head.\nWhen two SCMI drivers for the same protocol unregister concurrently, one\nthread can remove the final request and free the list head while the other\nis running its notifier. The latter then dereferences the freed list head\nafter reacquiring the mutex and can free it a second time.\n\nComplete the list and IDR updates, including freeing an empty list head,\nbefore dropping the mutex. Keep the blocking notifier outside the critical\nsection and retain only the detached request across the callback."
    }
  ],
  "lastModified": "2026-09-17T17:17:53.187",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}