GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-26893 (GCVE-0-2024-26893)

Vulnerability from cvelistv5 – Published: 2024-04-17 10:27 – Updated: 2026-05-11 20:06
VLAI
Title
firmware: arm_scmi: Fix double free in SMC transport cleanup path
Summary
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Fix double free in SMC transport cleanup path When the generic SCMI code tears down a channel, it calls the chan_free callback function, defined by each transport. Since multiple protocols might share the same transport_info member, chan_free() might want to clean up the same member multiple times within the given SCMI transport implementation. In this case, it is SMC transport. This will lead to a NULL pointer dereference at the second time: | scmi_protocol scmi_dev.1: Enabled polling mode TX channel - prot_id:16 | arm-scmi firmware:scmi: SCMI Notifications - Core Enabled. | arm-scmi firmware:scmi: unable to communicate with SCMI | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 | Mem abort info: | ESR = 0x0000000096000004 | EC = 0x25: DABT (current EL), IL = 32 bits | SET = 0, FnV = 0 | EA = 0, S1PTW = 0 | FSC = 0x04: level 0 translation fault | Data abort info: | ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 | CM = 0, WnR = 0, TnD = 0, TagAccess = 0 | GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 | user pgtable: 4k pages, 48-bit VAs, pgdp=0000000881ef8000 | [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 | Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP | Modules linked in: | CPU: 4 PID: 1 Comm: swapper/0 Not tainted 6.7.0-rc2-00124-g455ef3d016c9-dirty #793 | Hardware name: FVP Base RevC (DT) | pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) | pc : smc_chan_free+0x3c/0x6c | lr : smc_chan_free+0x3c/0x6c | Call trace: | smc_chan_free+0x3c/0x6c | idr_for_each+0x68/0xf8 | scmi_cleanup_channels.isra.0+0x2c/0x58 | scmi_probe+0x434/0x734 | platform_probe+0x68/0xd8 | really_probe+0x110/0x27c | __driver_probe_device+0x78/0x12c | driver_probe_device+0x3c/0x118 | __driver_attach+0x74/0x128 | bus_for_each_dev+0x78/0xe0 | driver_attach+0x24/0x30 | bus_add_driver+0xe4/0x1e8 | driver_register+0x60/0x128 | __platform_driver_register+0x28/0x34 | scmi_driver_init+0x84/0xc0 | do_one_initcall+0x78/0x33c | kernel_init_freeable+0x2b8/0x51c | kernel_init+0x24/0x130 | ret_from_fork+0x10/0x20 | Code: f0004701 910a0021 aa1403e5 97b91c70 (b9400280) | ---[ end trace 0000000000000000 ]--- Simply check for the struct pointer being NULL before trying to access its members, to avoid this situation. This was found when a transport doesn't really work (for instance no SMC service), the probe routines then tries to clean up, and triggers a crash.
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-16 15:26 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1dc6558062dadfabd2fb3bd885fa6e92ec7196f2 , < 0d276d9f335f41d6524258d58c0c0241ef9a83a4 (git)
Affected: 1dc6558062dadfabd2fb3bd885fa6e92ec7196f2 , < 857f56db8c3a71f9871922b6984ff74ad588cb2c (git)
Affected: 1dc6558062dadfabd2fb3bd885fa6e92ec7196f2 , < 8ffaa17ccb1eb1b65cf85db63225a3581c303773 (git)
Affected: 1dc6558062dadfabd2fb3bd885fa6e92ec7196f2 , < ead445dd3d681020af333649a27306160eee761d (git)
Affected: 1dc6558062dadfabd2fb3bd885fa6e92ec7196f2 , < f1d71576d2c9ec8fdb822173fa7f3de79475e9bd (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.8
Unaffected: 0 , < 5.8 (semver)
Unaffected: 6.1.83 , ≤ 6.1.* (semver)
Unaffected: 6.6.23 , ≤ 6.6.* (semver)
Unaffected: 6.7.11 , ≤ 6.7.* (semver)
Unaffected: 6.8.2 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26893",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-16T15:26:07.636666Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-16T15:26:17.892Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:05.507Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0d276d9f335f41d6524258d58c0c0241ef9a83a4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/857f56db8c3a71f9871922b6984ff74ad588cb2c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8ffaa17ccb1eb1b65cf85db63225a3581c303773"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ead445dd3d681020af333649a27306160eee761d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f1d71576d2c9ec8fdb822173fa7f3de79475e9bd"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/firmware/arm_scmi/smc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0d276d9f335f41d6524258d58c0c0241ef9a83a4",
              "status": "affected",
              "version": "1dc6558062dadfabd2fb3bd885fa6e92ec7196f2",
              "versionType": "git"
            },
            {
              "lessThan": "857f56db8c3a71f9871922b6984ff74ad588cb2c",
              "status": "affected",
              "version": "1dc6558062dadfabd2fb3bd885fa6e92ec7196f2",
              "versionType": "git"
            },
            {
              "lessThan": "8ffaa17ccb1eb1b65cf85db63225a3581c303773",
              "status": "affected",
              "version": "1dc6558062dadfabd2fb3bd885fa6e92ec7196f2",
              "versionType": "git"
            },
            {
              "lessThan": "ead445dd3d681020af333649a27306160eee761d",
              "status": "affected",
              "version": "1dc6558062dadfabd2fb3bd885fa6e92ec7196f2",
              "versionType": "git"
            },
            {
              "lessThan": "f1d71576d2c9ec8fdb822173fa7f3de79475e9bd",
              "status": "affected",
              "version": "1dc6558062dadfabd2fb3bd885fa6e92ec7196f2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/firmware/arm_scmi/smc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.83",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.23",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.11",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.2",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Fix double free in SMC transport cleanup path\n\nWhen the generic SCMI code tears down a channel, it calls the chan_free\ncallback function, defined by each transport. Since multiple protocols\nmight share the same transport_info member, chan_free() might want to\nclean up the same member multiple times within the given SCMI transport\nimplementation. In this case, it is SMC transport. This will lead to a NULL\npointer dereference at the second time:\n\n    | scmi_protocol scmi_dev.1: Enabled polling mode TX channel - prot_id:16\n    | arm-scmi firmware:scmi: SCMI Notifications - Core Enabled.\n    | arm-scmi firmware:scmi: unable to communicate with SCMI\n    | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n    | Mem abort info:\n    |   ESR = 0x0000000096000004\n    |   EC = 0x25: DABT (current EL), IL = 32 bits\n    |   SET = 0, FnV = 0\n    |   EA = 0, S1PTW = 0\n    |   FSC = 0x04: level 0 translation fault\n    | Data abort info:\n    |   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n    |   CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n    |   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n    | user pgtable: 4k pages, 48-bit VAs, pgdp=0000000881ef8000\n    | [0000000000000000] pgd=0000000000000000, p4d=0000000000000000\n    | Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP\n    | Modules linked in:\n    | CPU: 4 PID: 1 Comm: swapper/0 Not tainted 6.7.0-rc2-00124-g455ef3d016c9-dirty #793\n    | Hardware name: FVP Base RevC (DT)\n    | pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n    | pc : smc_chan_free+0x3c/0x6c\n    | lr : smc_chan_free+0x3c/0x6c\n    | Call trace:\n    |  smc_chan_free+0x3c/0x6c\n    |  idr_for_each+0x68/0xf8\n    |  scmi_cleanup_channels.isra.0+0x2c/0x58\n    |  scmi_probe+0x434/0x734\n    |  platform_probe+0x68/0xd8\n    |  really_probe+0x110/0x27c\n    |  __driver_probe_device+0x78/0x12c\n    |  driver_probe_device+0x3c/0x118\n    |  __driver_attach+0x74/0x128\n    |  bus_for_each_dev+0x78/0xe0\n    |  driver_attach+0x24/0x30\n    |  bus_add_driver+0xe4/0x1e8\n    |  driver_register+0x60/0x128\n    |  __platform_driver_register+0x28/0x34\n    |  scmi_driver_init+0x84/0xc0\n    |  do_one_initcall+0x78/0x33c\n    |  kernel_init_freeable+0x2b8/0x51c\n    |  kernel_init+0x24/0x130\n    |  ret_from_fork+0x10/0x20\n    | Code: f0004701 910a0021 aa1403e5 97b91c70 (b9400280)\n    | ---[ end trace 0000000000000000 ]---\n\nSimply check for the struct pointer being NULL before trying to access\nits members, to avoid this situation.\n\nThis was found when a transport doesn\u0027t really work (for instance no SMC\nservice), the probe routines then tries to clean up, and triggers a crash."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:06:27.416Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0d276d9f335f41d6524258d58c0c0241ef9a83a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/857f56db8c3a71f9871922b6984ff74ad588cb2c"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ffaa17ccb1eb1b65cf85db63225a3581c303773"
        },
        {
          "url": "https://git.kernel.org/stable/c/ead445dd3d681020af333649a27306160eee761d"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1d71576d2c9ec8fdb822173fa7f3de79475e9bd"
        }
      ],
      "title": "firmware: arm_scmi: Fix double free in SMC transport cleanup path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26893",
    "datePublished": "2024-04-17T10:27:45.332Z",
    "dateReserved": "2024-02-19T14:20:24.186Z",
    "dateUpdated": "2026-05-11T20:06:27.416Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26893",
      "date": "2026-09-16",
      "epss": "0.00227",
      "percentile": "0.13566"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfirmware: arm_scmi: Fix double free in SMC transport cleanup path\\n\\nWhen the generic SCMI code tears down a channel, it calls the chan_free\\ncallback function, defined by each transport. Since multiple protocols\\nmight share the same transport_info member, chan_free() might want to\\nclean up the same member multiple times within the given SCMI transport\\nimplementation. In this case, it is SMC transport. This will lead to a NULL\\npointer dereference at the second time:\\n\\n    | scmi_protocol scmi_dev.1: Enabled polling mode TX channel - prot_id:16\\n    | arm-scmi firmware:scmi: SCMI Notifications - Core Enabled.\\n    | arm-scmi firmware:scmi: unable to communicate with SCMI\\n    | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\\n    | Mem abort info:\\n    |   ESR = 0x0000000096000004\\n    |   EC = 0x25: DABT (current EL), IL = 32 bits\\n    |   SET = 0, FnV = 0\\n    |   EA = 0, S1PTW = 0\\n    |   FSC = 0x04: level 0 translation fault\\n    | Data abort info:\\n    |   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\\n    |   CM = 0, WnR = 0, TnD = 0, TagAccess = 0\\n    |   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\\n    | user pgtable: 4k pages, 48-bit VAs, pgdp=0000000881ef8000\\n    | [0000000000000000] pgd=0000000000000000, p4d=0000000000000000\\n    | Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP\\n    | Modules linked in:\\n    | CPU: 4 PID: 1 Comm: swapper/0 Not tainted 6.7.0-rc2-00124-g455ef3d016c9-dirty #793\\n    | Hardware name: FVP Base RevC (DT)\\n    | pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\\n    | pc : smc_chan_free+0x3c/0x6c\\n    | lr : smc_chan_free+0x3c/0x6c\\n    | Call trace:\\n    |  smc_chan_free+0x3c/0x6c\\n    |  idr_for_each+0x68/0xf8\\n    |  scmi_cleanup_channels.isra.0+0x2c/0x58\\n    |  scmi_probe+0x434/0x734\\n    |  platform_probe+0x68/0xd8\\n    |  really_probe+0x110/0x27c\\n    |  __driver_probe_device+0x78/0x12c\\n    |  driver_probe_device+0x3c/0x118\\n    |  __driver_attach+0x74/0x128\\n    |  bus_for_each_dev+0x78/0xe0\\n    |  driver_attach+0x24/0x30\\n    |  bus_add_driver+0xe4/0x1e8\\n    |  driver_register+0x60/0x128\\n    |  __platform_driver_register+0x28/0x34\\n    |  scmi_driver_init+0x84/0xc0\\n    |  do_one_initcall+0x78/0x33c\\n    |  kernel_init_freeable+0x2b8/0x51c\\n    |  kernel_init+0x24/0x130\\n    |  ret_from_fork+0x10/0x20\\n    | Code: f0004701 910a0021 aa1403e5 97b91c70 (b9400280)\\n    | ---[ end trace 0000000000000000 ]---\\n\\nSimply check for the struct pointer being NULL before trying to access\\nits members, to avoid this situation.\\n\\nThis was found when a transport doesn\u0027t really work (for instance no SMC\\nservice), the probe routines then tries to clean up, and triggers a crash.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: firmware: arm_scmi: Correcci\\u00f3n de doble liberaci\\u00f3n en la ruta de limpieza del transporte SMC Cuando el c\\u00f3digo SCMI gen\\u00e9rico destruye un canal, llama a la funci\\u00f3n de devoluci\\u00f3n de llamada chan_free, definida por cada transporte. Dado que varios protocolos pueden compartir el mismo miembro transport_info, es posible que chan_free() desee limpiar el mismo miembro varias veces dentro de la implementaci\\u00f3n de transporte SCMI determinada. En este caso se trata de transporte SMC. Esto dar\\u00e1 lugar a una desreferencia del puntero NULL la segunda vez: | scmi_protocol scmi_dev.1: Canal TX en modo de sondeo habilitado - prot_id:16 | firmware arm-scmi: scmi: Notificaciones SCMI: n\\u00facleo habilitado. | firmware arm-scmi: scmi: no se puede comunicar con SCMI | No se puede manejar la desreferencia del puntero NULL del kernel en la direcci\\u00f3n virtual 0000000000000000 | Informaci\\u00f3n de cancelaci\\u00f3n de memoria: | ESR = 0x0000000096000004 | EC = 0x25: DABT (EL actual), IL = 32 bits | CONJUNTO = 0, FnV = 0 | EA = 0, S1PTW = 0 | FSC = 0x04: error de traducci\\u00f3n de nivel 0 | Informaci\\u00f3n de cancelaci\\u00f3n de datos: | ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 | CM = 0, WnR = 0, TnD = 0, Acceso a etiquetas = 0 | GCS = 0, Superposici\\u00f3n = 0, DirtyBit = 0, Xs = 0 | pgtable de usuario: p\\u00e1ginas de 4k, VA de 48 bits, pgdp=0000000881ef8000 | [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 | Error interno: Ups: 0000000096000004 [#1] SMP ANTICIPADO | M\\u00f3dulos enlazados en: | CPU: 4 PID: 1 Comunicaciones: swapper/0 No contaminado 6.7.0-rc2-00124-g455ef3d016c9-dirty #793 | Nombre del hardware: FVP Base RevC (DT) | pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) | ordenador personal: smc_chan_free+0x3c/0x6c | lr: smc_chan_free+0x3c/0x6c | Rastreo de llamadas: | smc_chan_free+0x3c/0x6c | idr_for_each+0x68/0xf8 | scmi_cleanup_channels.isra.0+0x2c/0x58 | scmi_probe+0x434/0x734 | sonda_plataforma+0x68/0xd8 | realmente_probe+0x110/0x27c | __driver_probe_device+0x78/0x12c | dispositivo_sonda_controlador+0x3c/0x118 | __driver_attach+0x74/0x128 | bus_for_each_dev+0x78/0xe0 | driver_attach+0x24/0x30 | bus_add_driver+0xe4/0x1e8 | registro_controlador+0x60/0x128 | __platform_driver_register+0x28/0x34 | scmi_driver_init+0x84/0xc0 | do_one_initcall+0x78/0x33c | kernel_init_freeable+0x2b8/0x51c | kernel_init+0x24/0x130 | ret_from_fork+0x10/0x20 | C\\u00f3digo: f0004701 910a0021 aa1403e5 97b91c70 (b9400280) | ---[ end trace 0000000000000000 ]--- Simplemente verifique que el puntero de estructura sea NULL antes de intentar acceder a sus miembros, para evitar esta situaci\\u00f3n. Esto se encontr\\u00f3 cuando un transporte realmente no funciona (por ejemplo, sin servicio SMC), las rutinas de la sonda intentan limpiarse y provocan un bloqueo.\"}]",
      "id": "CVE-2024-26893",
      "lastModified": "2024-11-21T09:03:19.143",
      "published": "2024-04-17T11:15:10.577",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/0d276d9f335f41d6524258d58c0c0241ef9a83a4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/857f56db8c3a71f9871922b6984ff74ad588cb2c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/8ffaa17ccb1eb1b65cf85db63225a3581c303773\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/ead445dd3d681020af333649a27306160eee761d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/f1d71576d2c9ec8fdb822173fa7f3de79475e9bd\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/0d276d9f335f41d6524258d58c0c0241ef9a83a4\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/857f56db8c3a71f9871922b6984ff74ad588cb2c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/8ffaa17ccb1eb1b65cf85db63225a3581c303773\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/ead445dd3d681020af333649a27306160eee761d\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/f1d71576d2c9ec8fdb822173fa7f3de79475e9bd\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-31T15:17:57.000Z",
      "cve": "CVE-2024-26893",
      "id": "msrc_CVE-2024-26893",
      "initial_release_date": "2024-04-02T07:00:00.000Z",
      "product_status:under_investigation": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "firmware: arm_scmi: Fix double free in SMC transport cleanup path",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-26893.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26893\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-17T11:15:10.577\",\"lastModified\":\"2026-06-17T07:18:37.437\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfirmware: arm_scmi: Fix double free in SMC transport cleanup path\\n\\nWhen the generic SCMI code tears down a channel, it calls the chan_free\\ncallback function, defined by each transport. Since multiple protocols\\nmight share the same transport_info member, chan_free() might want to\\nclean up the same member multiple times within the given SCMI transport\\nimplementation. In this case, it is SMC transport. This will lead to a NULL\\npointer dereference at the second time:\\n\\n    | scmi_protocol scmi_dev.1: Enabled polling mode TX channel - prot_id:16\\n    | arm-scmi firmware:scmi: SCMI Notifications - Core Enabled.\\n    | arm-scmi firmware:scmi: unable to communicate with SCMI\\n    | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\\n    | Mem abort info:\\n    |   ESR = 0x0000000096000004\\n    |   EC = 0x25: DABT (current EL), IL = 32 bits\\n    |   SET = 0, FnV = 0\\n    |   EA = 0, S1PTW = 0\\n    |   FSC = 0x04: level 0 translation fault\\n    | Data abort info:\\n    |   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\\n    |   CM = 0, WnR = 0, TnD = 0, TagAccess = 0\\n    |   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\\n    | user pgtable: 4k pages, 48-bit VAs, pgdp=0000000881ef8000\\n    | [0000000000000000] pgd=0000000000000000, p4d=0000000000000000\\n    | Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP\\n    | Modules linked in:\\n    | CPU: 4 PID: 1 Comm: swapper/0 Not tainted 6.7.0-rc2-00124-g455ef3d016c9-dirty #793\\n    | Hardware name: FVP Base RevC (DT)\\n    | pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\\n    | pc : smc_chan_free+0x3c/0x6c\\n    | lr : smc_chan_free+0x3c/0x6c\\n    | Call trace:\\n    |  smc_chan_free+0x3c/0x6c\\n    |  idr_for_each+0x68/0xf8\\n    |  scmi_cleanup_channels.isra.0+0x2c/0x58\\n    |  scmi_probe+0x434/0x734\\n    |  platform_probe+0x68/0xd8\\n    |  really_probe+0x110/0x27c\\n    |  __driver_probe_device+0x78/0x12c\\n    |  driver_probe_device+0x3c/0x118\\n    |  __driver_attach+0x74/0x128\\n    |  bus_for_each_dev+0x78/0xe0\\n    |  driver_attach+0x24/0x30\\n    |  bus_add_driver+0xe4/0x1e8\\n    |  driver_register+0x60/0x128\\n    |  __platform_driver_register+0x28/0x34\\n    |  scmi_driver_init+0x84/0xc0\\n    |  do_one_initcall+0x78/0x33c\\n    |  kernel_init_freeable+0x2b8/0x51c\\n    |  kernel_init+0x24/0x130\\n    |  ret_from_fork+0x10/0x20\\n    | Code: f0004701 910a0021 aa1403e5 97b91c70 (b9400280)\\n    | ---[ end trace 0000000000000000 ]---\\n\\nSimply check for the struct pointer being NULL before trying to access\\nits members, to avoid this situation.\\n\\nThis was found when a transport doesn\u0027t really work (for instance no SMC\\nservice), the probe routines then tries to clean up, and triggers a crash.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: firmware: arm_scmi: Correcci\u00f3n de doble liberaci\u00f3n en la ruta de limpieza del transporte SMC Cuando el c\u00f3digo SCMI gen\u00e9rico destruye un canal, llama a la funci\u00f3n de devoluci\u00f3n de llamada chan_free, definida por cada transporte. Dado que varios protocolos pueden compartir el mismo miembro transport_info, es posible que chan_free() desee limpiar el mismo miembro varias veces dentro de la implementaci\u00f3n de transporte SCMI determinada. En este caso se trata de transporte SMC. Esto dar\u00e1 lugar a una desreferencia del puntero NULL la segunda vez: | scmi_protocol scmi_dev.1: Canal TX en modo de sondeo habilitado - prot_id:16 | firmware arm-scmi: scmi: Notificaciones SCMI: n\u00facleo habilitado. | firmware arm-scmi: scmi: no se puede comunicar con SCMI | No se puede manejar la desreferencia del puntero NULL del kernel en la direcci\u00f3n virtual 0000000000000000 | Informaci\u00f3n de cancelaci\u00f3n de memoria: | ESR = 0x0000000096000004 | EC = 0x25: DABT (EL actual), IL = 32 bits | CONJUNTO = 0, FnV = 0 | EA = 0, S1PTW = 0 | FSC = 0x04: error de traducci\u00f3n de nivel 0 | Informaci\u00f3n de cancelaci\u00f3n de datos: | ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 | CM = 0, WnR = 0, TnD = 0, Acceso a etiquetas = 0 | GCS = 0, Superposici\u00f3n = 0, DirtyBit = 0, Xs = 0 | pgtable de usuario: p\u00e1ginas de 4k, VA de 48 bits, pgdp=0000000881ef8000 | [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 | Error interno: Ups: 0000000096000004 [#1] SMP ANTICIPADO | M\u00f3dulos enlazados en: | CPU: 4 PID: 1 Comunicaciones: swapper/0 No contaminado 6.7.0-rc2-00124-g455ef3d016c9-dirty #793 | Nombre del hardware: FVP Base RevC (DT) | pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) | ordenador personal: smc_chan_free+0x3c/0x6c | lr: smc_chan_free+0x3c/0x6c | Rastreo de llamadas: | smc_chan_free+0x3c/0x6c | idr_for_each+0x68/0xf8 | scmi_cleanup_channels.isra.0+0x2c/0x58 | scmi_probe+0x434/0x734 | sonda_plataforma+0x68/0xd8 | realmente_probe+0x110/0x27c | __driver_probe_device+0x78/0x12c | dispositivo_sonda_controlador+0x3c/0x118 | __driver_attach+0x74/0x128 | bus_for_each_dev+0x78/0xe0 | driver_attach+0x24/0x30 | bus_add_driver+0xe4/0x1e8 | registro_controlador+0x60/0x128 | __platform_driver_register+0x28/0x34 | scmi_driver_init+0x84/0xc0 | do_one_initcall+0x78/0x33c | kernel_init_freeable+0x2b8/0x51c | kernel_init+0x24/0x130 | ret_from_fork+0x10/0x20 | C\u00f3digo: f0004701 910a0021 aa1403e5 97b91c70 (b9400280) | ---[ end trace 0000000000000000 ]--- Simplemente verifique que el puntero de estructura sea NULL antes de intentar acceder a sus miembros, para evitar esta situaci\u00f3n. Esto se encontr\u00f3 cuando un transporte realmente no funciona (por ejemplo, sin servicio SMC), las rutinas de la sonda intentan limpiarse y provocan un bloqueo.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/firmware/arm_scmi/smc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1dc6558062dadfabd2fb3bd885fa6e92ec7196f2\",\"lessThan\":\"0d276d9f335f41d6524258d58c0c0241ef9a83a4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1dc6558062dadfabd2fb3bd885fa6e92ec7196f2\",\"lessThan\":\"857f56db8c3a71f9871922b6984ff74ad588cb2c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1dc6558062dadfabd2fb3bd885fa6e92ec7196f2\",\"lessThan\":\"8ffaa17ccb1eb1b65cf85db63225a3581c303773\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1dc6558062dadfabd2fb3bd885fa6e92ec7196f2\",\"lessThan\":\"ead445dd3d681020af333649a27306160eee761d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1dc6558062dadfabd2fb3bd885fa6e92ec7196f2\",\"lessThan\":\"f1d71576d2c9ec8fdb822173fa7f3de79475e9bd\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/firmware/arm_scmi/smc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.83\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.23\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.11\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.2\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-07-16T15:26:07.636666Z\",\"id\":\"CVE-2024-26893\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-415\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.8\",\"versionEndExcluding\":\"6.1.83\",\"matchCriteriaId\":\"E8D30B4C-D66E-4ECB-8103-8CD9DFE724AA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.23\",\"matchCriteriaId\":\"E00814DC-0BA7-431A-9926-80FEB4A96C68\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.11\",\"matchCriteriaId\":\"9B95D3A6-E162-47D5-ABFC-F3FA74FA7CFD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.8.2\",\"matchCriteriaId\":\"543A75FF-25B8-4046-A514-1EA8EDD87AB1\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0d276d9f335f41d6524258d58c0c0241ef9a83a4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/857f56db8c3a71f9871922b6984ff74ad588cb2c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8ffaa17ccb1eb1b65cf85db63225a3581c303773\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ead445dd3d681020af333649a27306160eee761d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f1d71576d2c9ec8fdb822173fa7f3de79475e9bd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0d276d9f335f41d6524258d58c0c0241ef9a83a4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/857f56db8c3a71f9871922b6984ff74ad588cb2c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8ffaa17ccb1eb1b65cf85db63225a3581c303773\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ead445dd3d681020af333649a27306160eee761d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f1d71576d2c9ec8fdb822173fa7f3de79475e9bd\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2025-11-21T13:56:20+00:00",
      "cve": "CVE-2024-26893",
      "id": "CVE-2024-26893",
      "initial_release_date": "2024-04-17T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: firmware: arm_scmi: Fix double free in SMC transport cleanup path",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26893.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-30T02:43:14Z",
      "cve": "CVE-2024-26893",
      "id": "CVE-2024-26893",
      "initial_release_date": "2024-04-23T01:44:27Z",
      "product_status:known_affected": "310",
      "product_status:known_not_affected": "333",
      "product_status:recommended": "522",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-26893",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-26893.json",
      "version": "69"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/0d276d9f335f41d6524258d58c0c0241ef9a83a4\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/857f56db8c3a71f9871922b6984ff74ad588cb2c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/8ffaa17ccb1eb1b65cf85db63225a3581c303773\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ead445dd3d681020af333649a27306160eee761d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/f1d71576d2c9ec8fdb822173fa7f3de79475e9bd\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:21:05.507Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26893\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-07-16T15:26:07.636666Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-16T15:26:14.198Z\"}}], \"cna\": {\"title\": \"firmware: arm_scmi: Fix double free in SMC transport cleanup path\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"1dc6558062da\", \"lessThan\": \"0d276d9f335f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1dc6558062da\", \"lessThan\": \"857f56db8c3a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1dc6558062da\", \"lessThan\": \"8ffaa17ccb1e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1dc6558062da\", \"lessThan\": \"ead445dd3d68\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1dc6558062da\", \"lessThan\": \"f1d71576d2c9\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/firmware/arm_scmi/smc.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.83\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.23\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/firmware/arm_scmi/smc.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/0d276d9f335f41d6524258d58c0c0241ef9a83a4\"}, {\"url\": \"https://git.kernel.org/stable/c/857f56db8c3a71f9871922b6984ff74ad588cb2c\"}, {\"url\": \"https://git.kernel.org/stable/c/8ffaa17ccb1eb1b65cf85db63225a3581c303773\"}, {\"url\": \"https://git.kernel.org/stable/c/ead445dd3d681020af333649a27306160eee761d\"}, {\"url\": \"https://git.kernel.org/stable/c/f1d71576d2c9ec8fdb822173fa7f3de79475e9bd\"}], \"x_generator\": {\"engine\": \"bippy-9e1c9544281a\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfirmware: arm_scmi: Fix double free in SMC transport cleanup path\\n\\nWhen the generic SCMI code tears down a channel, it calls the chan_free\\ncallback function, defined by each transport. Since multiple protocols\\nmight share the same transport_info member, chan_free() might want to\\nclean up the same member multiple times within the given SCMI transport\\nimplementation. In this case, it is SMC transport. This will lead to a NULL\\npointer dereference at the second time:\\n\\n    | scmi_protocol scmi_dev.1: Enabled polling mode TX channel - prot_id:16\\n    | arm-scmi firmware:scmi: SCMI Notifications - Core Enabled.\\n    | arm-scmi firmware:scmi: unable to communicate with SCMI\\n    | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\\n    | Mem abort info:\\n    |   ESR = 0x0000000096000004\\n    |   EC = 0x25: DABT (current EL), IL = 32 bits\\n    |   SET = 0, FnV = 0\\n    |   EA = 0, S1PTW = 0\\n    |   FSC = 0x04: level 0 translation fault\\n    | Data abort info:\\n    |   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\\n    |   CM = 0, WnR = 0, TnD = 0, TagAccess = 0\\n    |   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\\n    | user pgtable: 4k pages, 48-bit VAs, pgdp=0000000881ef8000\\n    | [0000000000000000] pgd=0000000000000000, p4d=0000000000000000\\n    | Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP\\n    | Modules linked in:\\n    | CPU: 4 PID: 1 Comm: swapper/0 Not tainted 6.7.0-rc2-00124-g455ef3d016c9-dirty #793\\n    | Hardware name: FVP Base RevC (DT)\\n    | pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\\n    | pc : smc_chan_free+0x3c/0x6c\\n    | lr : smc_chan_free+0x3c/0x6c\\n    | Call trace:\\n    |  smc_chan_free+0x3c/0x6c\\n    |  idr_for_each+0x68/0xf8\\n    |  scmi_cleanup_channels.isra.0+0x2c/0x58\\n    |  scmi_probe+0x434/0x734\\n    |  platform_probe+0x68/0xd8\\n    |  really_probe+0x110/0x27c\\n    |  __driver_probe_device+0x78/0x12c\\n    |  driver_probe_device+0x3c/0x118\\n    |  __driver_attach+0x74/0x128\\n    |  bus_for_each_dev+0x78/0xe0\\n    |  driver_attach+0x24/0x30\\n    |  bus_add_driver+0xe4/0x1e8\\n    |  driver_register+0x60/0x128\\n    |  __platform_driver_register+0x28/0x34\\n    |  scmi_driver_init+0x84/0xc0\\n    |  do_one_initcall+0x78/0x33c\\n    |  kernel_init_freeable+0x2b8/0x51c\\n    |  kernel_init+0x24/0x130\\n    |  ret_from_fork+0x10/0x20\\n    | Code: f0004701 910a0021 aa1403e5 97b91c70 (b9400280)\\n    | ---[ end trace 0000000000000000 ]---\\n\\nSimply check for the struct pointer being NULL before trying to access\\nits members, to avoid this situation.\\n\\nThis was found when a transport doesn\u0027t really work (for instance no SMC\\nservice), the probe routines then tries to clean up, and triggers a crash.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-11-05T09:17:45.161Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26893\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-05T09:17:45.161Z\", \"dateReserved\": \"2024-02-19T14:20:24.186Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-17T10:27:45.332Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.