SB20260918129 - Missing Release of Resource after Effective Lifetime in Linux kernel arm_scmi transports driver

Description

This security bulletin contains information about 1 vulnerability.

1) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-93083)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to missing release of a resource after its effective lifetime in mailbox_chan_setup() when requesting an additional unidirectional TX receiver mailbox channel. A local user can initiate mailbox channel setup to cause a denial of service.

The primary mailbox channel remains busy for later probe attempts if the additional channel request fails.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/6f7c06744d53dc8e047725d411d7f915d9ec35ae
• https://git.kernel.org/stable/c/717b8e972a667fc1bebe63cbcf0d58e692cbb491
• https://git.kernel.org/stable/c/9958f55eace8b43713c9fc54dcf90e7cdefee413
• https://git.kernel.org/stable/c/babb017cf5e4600c94c23ea87175a0380235a3ee