CVE-2026-92490

A flaw was found in the Linux kernel's ARM System Control and Management Interface (SCMI) firmware driver. When a driver fails to register, the system may not properly unregister associated protocol devices, leaving behind invalid references. This can lead to the system attempting to access memory that is no longer valid, potentially causing system instability or a crash.

This vulnerability is rated as Moderate severity because exploitation is restricted to local vectors and results primarily in a kernel crash (denial of service) rather than privilege escalation or data exposure. The flaw only affects systems running ARM architectures that utilize the System Control and Management Interface (SCMI) firmware protocol, and it requires an unusual condition where driver registration fails. Earlier enterprise releases, including Red Hat Enterprise Linux 8 and 9, are not affected as the vulnerable code was introduced in later upstream kernel versions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.