CVE-2026-90397

A flaw was found in the Linux kernel's Qualcomm (qcom) Secure Channel Manager (SCM) firmware component. This vulnerability allows for a NULL pointer dereference due to improper initialization of a shared memory pointer. An attacker could exploit this timing issue, potentially leading to a system crash and a Denial of Service (DoS) for the affected system.

This vulnerability is rated Moderate because exploitation is limited to a local denial of service through a kernel crash on specific hardware, with no loss of confidentiality or system integrity. The flaw strictly impacts deployments running on Qualcomm-based hardware architectures that initialize the Qualcomm Secure Channel Manager (SCM) driver. Standard Red Hat Enterprise Linux environments operating on traditional x86_64 servers or other non-Qualcomm platforms do not exercise this initialization path and are not exposed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.