CVE-2026-93093

A flaw was found in the Linux kernel's ARM System Control and Management Interface (SCMI) firmware. During the SCMI channel setup, a race condition can occur where callbacks are enabled before the channel state is fully initialized. If a callback fires in this window, it can lead to a null pointer dereference. This vulnerability can cause a system fault, resulting in a Denial of Service (DoS).

This vulnerability is rated as having a Low severity impact because it is restricted to ARM-based hardware utilizing the SCMI transport interface and occurs only under specific timing conditions during early device initialization. Standard x86_64, PowerPC, and s390x deployments do not load or expose this interface, making them unaffected. Even on supported ARM hardware, triggering the race condition requires an untimely interrupt prior to state assignment, which cannot be initiated at will by unprivileged local users and results at most in a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.