VulnerabilityPublished 17 Sep 2026Updated 30 Oct 2026

CVE-2026-93093: Linux kernel · firmware: arm_scmi: Publish channel state before callbacks

Source GCVE Database

Compare

Authoritative record:CVE-2026-93093· Medium

Not known to be exploited · fixed in a1bc587568a4e373db76261dc9561dfc3653917f : update Linux kernel when convenient.

Data as of 30 Oct 2026, 18:18 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in a1bc587568a4e373db76261dc9561dfc3653917f, 0314900dcdde044af0208fed212035dbfaa55843, 50e38091a657ad81385e2aea7e2575e17ac23d79 +3

Exploitation evidence

Disclosed: evidence found.
CVE published 17 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-wj2w-288c-r9m4

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 5c8a47a5a91d4d6e185f758d61997613d9c5d6ac, < a1bc587568a4e373db76261dc9561dfc3653917f	Fixed in a1bc587568a4e373db76261dc9561dfc3653917f
LinuxLinux	Affected ≥ 5c8a47a5a91d4d6e185f758d61997613d9c5d6ac, < 0314900dcdde044af0208fed212035dbfaa55843	Fixed in 0314900dcdde044af0208fed212035dbfaa55843
LinuxLinux	Affected ≥ 5c8a47a5a91d4d6e185f758d61997613d9c5d6ac, < 50e38091a657ad81385e2aea7e2575e17ac23d79	Fixed in 50e38091a657ad81385e2aea7e2575e17ac23d79
LinuxLinux	Affected ≥ 5c8a47a5a91d4d6e185f758d61997613d9c5d6ac, < 9d349c7b2392b1196e10421421ea9a09fcc5d3cc	Fixed in 9d349c7b2392b1196e10421421ea9a09fcc5d3cc
LinuxLinux	Affected ≥ 5c8a47a5a91d4d6e185f758d61997613d9c5d6ac, < 6f3f532531e4a27d28a2240719d1b05ac11766c6	Fixed in 6f3f532531e4a27d28a2240719d1b05ac11766c6
LinuxLinux	Affected ≥ 5c8a47a5a91d4d6e185f758d61997613d9c5d6ac, < 1bea027f7ef6fb889628b16c568a5f7c07a51b30	Fixed in 1bea027f7ef6fb889628b16c568a5f7c07a51b30

AI-suggested

A fix has been implemented in the Linux kernel to assign cinfo->handle before invoking transport setup callbacks and to publish channel state before enabling callbacks. Users should update to the fixed kernel version once available. No additional mitigation steps are described or required.

Description

A vulnerability in the Linux kernel's arm_scmi firmware component involves improper ordering of channel state publication and callback invocation during transport setup. Early callbacks can dereference NULL pointers, potentially causing faults. The issue has been resolved by ensuring channel state is published before callbacks are enabled and by cleaning up resources on setup failure.

Impact

If a pending or spurious callback occurs before channel state is fully published, the transport RX callback may dereference NULL pointers, causing kernel faults. This could lead to system instability or crashes. There is no indication of remote code execution or privilege escalation from the provided data.

Summary

The Linux kernel arm_scmi firmware transport setup could enable callbacks before completing channel state publication. Specifically, mailbox_chan_setup() and smc_chan_setup() could trigger callbacks that dereference NULL transport cinfo pointers or NULL handles, leading to faults. The fix assigns cinfo->handle before invoking callbacks, publishes transport-private channel state before requesting mailbox channels or IRQs, and clears pointers on setup failure to prevent stale state.

References

Community reviews

Loading reviews…