Memory leak in Linux kernel - CVE-2026-93084
Published: September 18, 2026
Vulnerability identifier: #VU150925
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-93084
CWE-ID: CWE-401
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to leak SCMI instance user references.
The vulnerability exists due to improper resource cleanup in the SCMI bus notifier when a protocol driver probe fails after an SCMI handle has been acquired. A local user can trigger a failed protocol-device bind to leak SCMI instance user references.
If a device dependency link cannot be created, a concurrent parent unbind can tear down the SCMI instance while the child retains a handle.
Affected software
Linux kernel
How to mitigate CVE-2026-93084
Install security update from vendor's repository.
External References
- https://git.kernel.org/stable/c/0f860db24ee95e5da4866303a35e55098b9641b3
- https://git.kernel.org/stable/c/77d2985d1e80e67f32026fc03e975c4c83cc543d
- https://git.kernel.org/stable/c/a54dc23e8bd2246c28eafffa60b4634f0d1a11cc
- https://git.kernel.org/stable/c/df273eced7cec550465fd1bb82a5d2c3c7d3c437
- https://git.kernel.org/stable/c/e3a5c30d233ca5d3e799a80da806554c703bda13