CVE-2026-92490

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-92490", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-16T12:21:13.871Z", "datePublished": "2026-09-17T16:10:05.347Z", "dateUpdated": "2026-10-30T12:35:40.981Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:35:40.981Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Unrequest devices if driver registration fails\n\nscmi_driver_register() requests protocol devices before registering the\ndriver. If driver_register() fails, those requests remain in the global\nIDR and retain pointers to the module's ID table. Once the failed module\nload releases that storage, later request matching or SCMI device creation\ncan dereference the stale pointers.\n\nUnrequest the complete protocol table before returning the registration\nfailure. At this point table registration succeeded, so every entry is\nowned by the current registration attempt."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/firmware/arm_scmi/bus.c"], "versions": [{"version": "a6fe96b2e371d5fd300cca24459cdcf471c2c741", "lessThan": "35a36fbbc985135f0d35a89d7f9d035ffc499d6e", "status": "affected", "versionType": "git"}, {"version": "d3cd7c525fd2ecce3a6c963f314969a54783d211", "lessThan": "524e57035af2d32498af9dd8fa6fdc92fcc8f80a", "status": "affected", "versionType": "git"}, {"version": "d3cd7c525fd2ecce3a6c963f314969a54783d211", "lessThan": "06e65e07a1bcb39a1ebc8bb89a981f8e07900497", "status": "affected", "versionType": "git"}, {"version": "d3cd7c525fd2ecce3a6c963f314969a54783d211", "lessThan": "a76b20b1f03099204db29b90e1024fe1c2b2cdd7", "status": "affected", "versionType": "git"}, {"version": "d3cd7c525fd2ecce3a6c963f314969a54783d211", "lessThan": "4520d4a1db37198756ad23568e36cdf091b6ffff", "status": "affected", "versionType": "git"}, {"version": "d3cd7c525fd2ecce3a6c963f314969a54783d211", "lessThan": "9f7cd6a62aa754ed6b48cbd5d50de40add1bcc86", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/firmware/arm_scmi/bus.c"], "versions": [{"version": "6.3", "status": "affected"}, {"version": "0", "lessThan": "6.3", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.157", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.110", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.52", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.6", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.6.157"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.12.110"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.18.52"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "7.2.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/35a36fbbc985135f0d35a89d7f9d035ffc499d6e"}, {"url": "https://git.kernel.org/stable/c/524e57035af2d32498af9dd8fa6fdc92fcc8f80a"}, {"url": "https://git.kernel.org/stable/c/06e65e07a1bcb39a1ebc8bb89a981f8e07900497"}, {"url": "https://git.kernel.org/stable/c/a76b20b1f03099204db29b90e1024fe1c2b2cdd7"}, {"url": "https://git.kernel.org/stable/c/4520d4a1db37198756ad23568e36cdf091b6ffff"}, {"url": "https://git.kernel.org/stable/c/9f7cd6a62aa754ed6b48cbd5d50de40add1bcc86"}], "title": "firmware: arm_scmi: Unrequest devices if driver registration fails", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/firmware/arm_scmi/bus.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "35a36fbbc985135f0d35a89d7f9d035ffc499d6e", "status": "affected", "version": "a6fe96b2e371d5fd300cca24459cdcf471c2c741", "versionType": "git"}, {"lessThan": "524e57035af2d32498af9dd8fa6fdc92fcc8f80a", "status": "affected", "version": "d3cd7c525fd2ecce3a6c963f314969a54783d211", "versionType": "git"}, {"lessThan": "06e65e07a1bcb39a1ebc8bb89a981f8e07900497", "status": "affected", "version": "d3cd7c525fd2ecce3a6c963f314969a54783d211", "versionType": "git"}, {"lessThan": "a76b20b1f03099204db29b90e1024fe1c2b2cdd7", "status": "affected", "version": "d3cd7c525fd2ecce3a6c963f314969a54783d211", "versionType": "git"}, {"lessThan": "4520d4a1db37198756ad23568e36cdf091b6ffff", "status": "affected", "version": "d3cd7c525fd2ecce3a6c963f314969a54783d211", "versionType": "git"}, {"lessThan": "9f7cd6a62aa754ed6b48cbd5d50de40add1bcc86", "status": "affected", "version": "d3cd7c525fd2ecce3a6c963f314969a54783d211", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/firmware/arm_scmi/bus.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.3"}, {"lessThan": "6.3", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.157", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.110", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.52", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Unrequest devices if driver registration fails\n\nscmi_driver_register() requests protocol devices before registering the\ndriver. If driver_register() fails, those requests remain in the global\nIDR and retain pointers to the module's ID table. Once the failed module\nload releases that storage, later request matching or SCMI device creation\ncan dereference the stale pointers.\n\nUnrequest the complete protocol table before returning the registration\nfailure. At this point table registration succeeded, so every entry is\nowned by the current registration attempt."}], "id": "CVE-2026-92490", "lastModified": "2026-10-30T13:20:55.313", "metrics": {}, "published": "2026-09-17T17:17:51.123", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/06e65e07a1bcb39a1ebc8bb89a981f8e07900497"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/35a36fbbc985135f0d35a89d7f9d035ffc499d6e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4520d4a1db37198756ad23568e36cdf091b6ffff"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/524e57035af2d32498af9dd8fa6fdc92fcc8f80a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9f7cd6a62aa754ed6b48cbd5d50de40add1bcc86"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a76b20b1f03099204db29b90e1024fe1c2b2cdd7"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d3cd7c525fd2ecce3a6c963f314969a54783d211,524e57035af2d32498af9dd8fa6fdc92fcc8f80a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d3cd7c525fd2ecce3a6c963f314969a54783d211,06e65e07a1bcb39a1ebc8bb89a981f8e07900497)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d3cd7c525fd2ecce3a6c963f314969a54783d211,a76b20b1f03099204db29b90e1024fe1c2b2cdd7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d3cd7c525fd2ecce3a6c963f314969a54783d211,4520d4a1db37198756ad23568e36cdf091b6ffff)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d3cd7c525fd2ecce3a6c963f314969a54783d211,9f7cd6a62aa754ed6b48cbd5d50de40add1bcc86)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.157,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.110,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.52,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.6,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-19T13:45:15.365910+00:00", "updated": "2026-09-19T20:15:18.286560+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-416"]}