CVE-2026-92490 firmware: arm_scmi: Unrequest devices if driver registration fails
A use-after-free in the Linux kernel SCMI driver allows local attackers to cause a crash or potentially execute code if driver registration fails.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-92490?
CVE-2026-92490 is an use after free vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_scmi: Unrequest devices if driver registration fails
scmi_driver_register() requests protocol devices before registering the driver. If driver_register() fails, those requests remain in the global IDR and retain pointers to the module's ID table. Once the failed module load releases that storage, later request matching or SCMI device creation can dereference the stale pointers.
Unrequest the complete protocol table before returning the registration failure. At this point table registration succeeded, so every entry is owned by the current registration attempt.
Which versions are affected by CVE-2026-92490?
How do I fix CVE-2026-92490?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-92490 being exploited?
There is no known exploitation of CVE-2026-92490 in the wild and no public exploit code.
Sources
Also known as AZL-102597, BELL-CVE-2026-92490, DEBIAN-CVE-2026-92490, GHSA-xhxg-9qcq-hmmp, UBUNTU-CVE-2026-92490.