- —Not scoredno CVSS score yet
- 0.21%Exploitation in 30 daysEPSS · top 89% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Quiesce notifications before teardown scmi_notification_exit() clears and releases the notification instance, but transport callbacks can still deliver incoming notifications until the TX/RX channels are freed. During remove, an RX interrupt in that window can enter scmi_notify() while notification state is being torn down and then dereference freed memory. The same ordering exists on the probe error path after notification initialization. The notification late-init worker has a separate lifetime issue: protocol event registration queues ni->init_work on the system workqueue, so destroying ni->notify_wq does not drain that work. If the devres group is released while init_work is still pending or running, the late-init worker can dereference the freed notification instance. Quiesce the notification core before TX/RX channels are torn down, then clean up the channels before releasing the notification core resources. Use disable_work_sync() so future late-init queueing is rejected and any already queued or running late-init work has completed before channel teardown starts.
Timeline
ID reserved
By Linux
Published
- 32 days later
· 32 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.21% · top 89% of all CVEs (11 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 1e7cbfaa66d39e78bd24df0c78b55df68176b59e – < 6778bcabd2e0c32f73476f0bc6369013692540be
- affected 1e7cbfaa66d39e78bd24df0c78b55df68176b59e – < 2aac23bc0a79af41104d99823bb250fae92ba144
- affected 1e7cbfaa66d39e78bd24df0c78b55df68176b59e – < 5e30d3d16d1a9e599be4dcea872874e65e2c277b
- affected 1e7cbfaa66d39e78bd24df0c78b55df68176b59e – < 8e49055d0d495c9c07575ad8e111d9eaf0efb13f
- affected 5.15
- unaffected < 5.15
- unaffected 6.12.110 – ≤ 6.12.*
- unaffected 6.18.52 – ≤ 6.18.*
- unaffected 7.2.6 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References4
- https://git.kernel.org/stable/c/6778bcabd2e0c32f73476f0bc6369013692540be (opens in a new tab)
- https://git.kernel.org/stable/c/2aac23bc0a79af41104d99823bb250fae92ba144 (opens in a new tab)
- https://git.kernel.org/stable/c/5e30d3d16d1a9e599be4dcea872874e65e2c277b (opens in a new tab)
- https://git.kernel.org/stable/c/8e49055d0d495c9c07575ad8e111d9eaf0efb13f (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-82199 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-93091)Record last updated .