Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-93092— firmware: arm_scmi: Unregister device notifier before IDR teardown

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： 固件：arm_scmi：在销毁 IDR 之前取消注册设备通知器 请求设备（requested-devices）通知器会从 IDR（ID 分配器/句柄管理器）中查找协议固件节点（fwnode）。在设备移除过程中，应在释放并销毁 之前取消注册该通知器，以防止通知器回调与 IDR 的拆除过程发生竞态条件。 同时，保持总线通知器注册状态，直至协议状态完成拆除，以符合 SCMI 总线现有移除操作中的顺序要求。

AI Predicted 7.5 Difficulty: Moderate EPSS 0.17% · P6

Possible ATT&CK Techniques 2 AI

T1024 T1615 · Group Policy Discovery

Affected Version Matrix 12

VendorProduct Version RangeStatus
Linux Linux 53b8c25df7082edd78a3fc63e359abee0f28fa70< 70a26b37389846f1f29a09f7983aa3f45feff529 affected
53b8c25df7082edd78a3fc63e359abee0f28fa70< 492fb49eac24beecd6d3c5e4744a513e626f8dcf affected
53b8c25df7082edd78a3fc63e359abee0f28fa70< f5e528f631425416f9b39e9d8b385c9f1ceb40d6 affected
53b8c25df7082edd78a3fc63e359abee0f28fa70< 74fcaa0a3f7ad3edfde2e8c6cb8ae457a00e0b7a affected
53b8c25df7082edd78a3fc63e359abee0f28fa70< 66a0bbf30cc14140fe13f63cd594a7c1ee352b75 affected
6.3 affected
< 6.3 unaffected
6.6.157≤ 6.6.* unaffected
… +4 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-93092

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
firmware: arm_scmi: Unregister device notifier before IDR teardown
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Unregister device notifier before IDR teardown The requested-devices notifier looks up protocol fwnodes from the active_protocols IDR. During remove, unregister the notifier before releasing and destroying active_protocols so no notifier callback can race with the IDR teardown. Keep the bus notifier registered until after the protocol state is torn down, matching the existing remove ordering for SCMI bus users.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 53b8c25df7082edd78a3fc63e359abee0f28fa70 ~ 70a26b37389846f1f29a09f7983aa3f45feff529 -
Linux Linux 6.3 -

II. Public POCs for CVE-2026-93092

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-93092

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-93092 (4)

Same Patch Batch · Linux · 2026-09-17 · 600 CVEs total

CVE-2026-92489 9.8 CRITICAL xfrm: Fix skb double-free in xfrm_dev_direct_output()
CVE-2026-90173 9.8 CRITICAL smb: smbdirect: free completion queues with ib_free_cq()
CVE-2026-90235 9.8 CRITICAL sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE
CVE-2026-90104 9.8 CRITICAL NFSv4.1: zero referring call lists before decoding
CVE-2026-90151 9.8 CRITICAL NFSv4: remove callback IDR entry on client allocation failure
CVE-2026-90110 9.4 CRITICAL inetpeer: randomize RB-tree node comparison using SipHash
CVE-2026-90230 9.1 CRITICAL nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()
CVE-2026-90414 9.1 CRITICAL IB/isert: reject PDUs declaring more data than was received
CVE-2026-90413 9.1 CRITICAL IB/isert: reject login PDUs declaring more data than was received
CVE-2026-90367 8.8 HIGH wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER
CVE-2026-90329 8.8 HIGH HID: synchronize input before cleaning up a failed probe
CVE-2026-93189 8.8 HIGH HID: core: quiesce input in hid_hw_stop() to prevent use-after-free
CVE-2026-90286 8.8 HIGH drm/amdgpu/gfx6: Use PFP on the compute queues too
CVE-2026-90357 8.8 HIGH wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement
CVE-2026-90240 8.8 HIGH iommu/vt-d: Flush context cache with correct SID when tearing down aliases
CVE-2026-93042 8.8 HIGH dmaengine: dw-edma: Terminate all descriptors without callbacks
CVE-2026-90256 8.8 HIGH Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind
CVE-2026-90380 8.8 HIGH wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete
CVE-2026-90381 8.8 HIGH wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()
CVE-2026-90425 8.8 HIGH iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID

Showing top 20 of 600 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-93092

No comments yet

Leave a comment