{"cve":"CVE-2026-93093","nvd":{"published":"2026-09-17T17:18:03.300","modified":"2026-10-21T13:20:59.323","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Publish channel state before callbacks\n\nTransport setup can enable callbacks before the setup routine returns.\nmailbox_chan_setup() registers the mailbox client with\nmbox_request_channel(), and the mailbox controller startup path can enable\ninterrupt delivery before SCMI mailbox channel state has been published.\nSimilarly, smc_chan_setup() requests the optional A2P completion IRQ before\nthe SMC transport has made its cinfo pointer visible.\n\nIf a pending or spurious callback fires in those windows, the transport RX\ncallback can dereference a NULL transport cinfo pointer. Publishing only\nthe transport-private pointer is not sufficient either: an early callback\ncan enter the SCMI core before scmi_chan_setup() has assigned\ncinfo->handle.\nThe core derives scmi_info from cinfo->handle in the RX path, so a NULL\nhandle can still fault even when the transport-private cinfo is valid.\n\nAssign cinfo->handle before invoking the transport setup callback. Publish\nthe mailbox and SMC transport-private channel state before requesting the\nmailbox channels or IRQ, and clear the early-published pointers again on\nsetup failure. Also unwind mailbox setup devres resources on failure so an\noptional RX setup error that is ignored by the core does not leave stale\ntransport state behind.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/0314900dcdde044af0208fed212035dbfaa55843","https://git.kernel.org/stable/c/1bea027f7ef6fb889628b16c568a5f7c07a51b30","https://git.kernel.org/stable/c/50e38091a657ad81385e2aea7e2575e17ac23d79","https://git.kernel.org/stable/c/6f3f532531e4a27d28a2240719d1b05ac11766c6","https://git.kernel.org/stable/c/a1bc587568a4e373db76261dc9561dfc3653917f"],"products":[],"source":"nvd","synced_at":"2026-10-22T16:41:11.231219466+00:00"},"epss":{"cve":"CVE-2026-93093","score":0.00168,"percentile":0.06159,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}