PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-93082 Linux CVE debrief

The Linux kernel has a vulnerability in the firmware: arm_scmi module. When the mailbox_chan_setup function requests an additional P2A receiver channel after acquiring the primary P2A channel and the request fails, the function returns immediately without freeing the primary channel. This leaves the primary channel allocated, potentially causing issues for later probe attempts.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-17
Original CVE updated
2026-10-19
Advisory published
2026-09-17
Advisory updated
2026-10-19

Who should care

Linux kernel maintainers, users, and administrators should review and apply patches to prevent potential issues. This includes verifying patch application to prevent channel allocation issues, monitoring for potential problems with primary channel allocation, and reviewing Linux kernel versions for vulnerability. The vulnerability in the Linux kernel's firmware: arm_scmi module requires attention from maintainers and users to review and apply patches, and

Why it matters

The vulnerability in the Linux kernel's firmware: arm_scmi module requires attention from maintainers and users to review and apply patches, ensuring proper channel allocation and preventing potential issues.

  • Verify patch application to prevent channel allocation issues
  • Monitor for potential problems with primary channel allocation
  • Review Linux kernel versions for vulnerability

Technical summary

The vulnerability is in the firmware: arm_scmi module of the Linux kernel. The mailbox_chan_setup function does not properly handle failures when requesting an additional P2A receiver channel, potentially leaving the primary channel allocated. This leaves the primary channel allocated, potentially causing issues for later probe attempts. The vulnerability requires attention from maintainers and users to review and apply patches, ensuring proper channel allocation and preventing potential issues. Linux kernel maintainers, users, and administrators should review and apply patches to prevent potential issues.

Defensive priority

Medium priority for Linux kernel maintainers and users to review and apply patches.

Recommended defensive actions

  • Review and apply patches for the firmware: arm_scmi module
  • Update Linux kernel to the latest version
  • Monitor for potential issues with the primary channel allocation
  • Verify patch application to prevent channel allocation issues
  • Review Linux kernel versions for vulnerability
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. However, the CVSS score and severity are not provided. The vulnerability is in the firmware: arm_scmi module of the Linux kernel. The mailbox_chan_setup function does not properly handle failures when requesting an additional P2A receiver channel, potentially leaving the primary channel allocated. Linux kernel maintainers, users, and administrators should review and apply patches to prevent potential issues. Verify the

Sources and references

Verified primary and authoritative sources

  • CVE-2026-93082 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-93082

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-93082 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-93082

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • firmware: arm_scmi: Unwind P2A receiver mailbox setup failure

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93082.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4c2a5d72357e5c6743c23b59615da287140d9d31

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3b0b02134ab90202af80b102fa37196b9689e86f

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3515aed7fe424b79c49ff9cd51f7802a64a4ab7b

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f3e3773c4e5e96549d7540d8ddeb4fcd534f6f1d

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.