CVE-2026-93081 firmware: arm_scmi: Fix SCMI device destroy lifetimes
A use-after-free in the Linux kernel SCMI driver allows local attackers to execute code or escalate privileges via race conditions during device destruction.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93081?
CVE-2026-93081 is an use after free vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_scmi: Fix SCMI device destroy lifetimes
scmi_child_dev_find() drops the reference returned by device_find_child() before returning the scmi_device pointer. A concurrent unregister can then release the device while the destroy path is still using the returned pointer.
Make the lookup helper return the device_find_child() reference and keep it until scmi_device_destroy() has finished unregistering the child.
Also split device_unregister() in __scmi_device_destroy() so the SCMI bus ID is not made reusable until after device_del() has removed the old scmi_dev.N name from sysfs. This avoids a new SCMI device reusing the same ID while the old device is still registered.
The final device release callback is also a possible cleanup path when SCMI children are deleted by driver core recursion rather than __scmi_device_destroy(). Release the SCMI bus ID from a common helper used by destroy, register-failure and final-release paths, and clear scmi_dev->id after freeing it so the final release cannot free the same ID again.
Which versions are affected by CVE-2026-93081?
How do I fix CVE-2026-93081?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-93081 being exploited?
There is no known exploitation of CVE-2026-93081 in the wild and no public exploit code.
Sources
Also known as AZL-103038, BELL-CVE-2026-93081, DEBIAN-CVE-2026-93081, GHSA-x6gc-qjww-67r2, UBUNTU-CVE-2026-93081.