{"cve":"CVE-2026-93084","nvd":{"published":"2026-09-17T17:18:02.460","modified":"2026-10-19T10:16:58.380","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Drop handle on protocol bind failures\n\nThe SCMI bus notifier acquires an SCMI handle when the driver core emits\nBUS_NOTIFY_BIND_DRIVER, before invoking the protocol driver probe\ncallback. The protocol probe path only checks whether sdev->handle is\nset.\n\nIf device_link_add() fails after the handle has been acquired, the\nprotocol device can still bind with a valid handle but without the\ndependency link to the SCMI parent. A concurrent parent unbind can then\nmiss the child and tear down the SCMI instance while the child still\nholds a handle into it.\n\nIf the protocol driver probe later fails, for example with\n-EPROBE_DEFER, the driver core emits BUS_NOTIFY_DRIVER_NOT_BOUND rather\nthan BUS_NOTIFY_UNBOUND_DRIVER. The SCMI notifier only released the\nhandle on BUS_NOTIFY_UNBOUND_DRIVER, so each failed protocol-device bind\nleaked the SCMI instance users refcount and left sdev->handle set after\nthe failed probe.\n\nMake the link helper report failure and drop the acquired handle if the\nlink cannot be created. Also handle BUS_NOTIFY_DRIVER_NOT_BOUND in the\nsame cleanup path used for unbind so failed probes balance the earlier\nBUS_NOTIFY_BIND_DRIVER acquisition.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/0f860db24ee95e5da4866303a35e55098b9641b3","https://git.kernel.org/stable/c/77d2985d1e80e67f32026fc03e975c4c83cc543d","https://git.kernel.org/stable/c/a54dc23e8bd2246c28eafffa60b4634f0d1a11cc","https://git.kernel.org/stable/c/df273eced7cec550465fd1bb82a5d2c3c7d3c437","https://git.kernel.org/stable/c/e3a5c30d233ca5d3e799a80da806554c703bda13"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:55:23.253742848+00:00"},"epss":{"cve":"CVE-2026-93084","score":0.00209,"percentile":0.10932,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}