In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_scmi: Fix double free in SMC transport cleanup path
When the generic SCMI code tears down a channel, it calls the chan_free callback function, defined by each transport. Since multiple protocols might share the same transport_info member, chan_free() might want to clean up the same member multiple times within the given SCMI transport implementation. In this case, it is SMC transport. This will lead to a NULL pointer dereference at the second time:
| scmi_protocol scmi_dev.1: Enabled polling mode TX channel - prot_id:16 | arm-scmi firmware:scmi: SCMI Notifications - Core Enabled. | arm-scmi firmware:scmi: unable to communicate with SCMI | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 | Mem abort info: | ESR = 0x0000000096000004 | EC = 0x25: DABT (current EL), IL = 32 bits | SET = 0, FnV = 0 | EA = 0, S1PTW = 0 | FSC = 0x04: level 0 translation fault | Data abort info: | ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 | CM = 0, WnR = 0, TnD = 0, TagAccess = 0 | GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 | user pgtable: 4k pages, 48-bit VAs, pgdp=0000000881ef8000 | [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 | Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP | Modules linked in: | CPU: 4 PID: 1 Comm: swapper/0 Not tainted 6.7.0-rc2-00124-g455ef3d016c9-dirty #793 | Hardware name: FVP Base RevC (DT) | pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) | pc : smc_chan_free+0x3c/0x6c | lr : smc_chan_free+0x3c/0x6c | Call trace: | smc_chan_free+0x3c/0x6c | idr_for_each+0x68/0xf8 | scmi_cleanup_channels.isra.0+0x2c/0x58 | scmi_probe+0x434/0x734 | platform_probe+0x68/0xd8 | really_probe+0x110/0x27c | __driver_probe_device+0x78/0x12c | driver_probe_device+0x3c/0x118 | __driver_attach+0x74/0x128 | bus_for_each_dev+0x78/0xe0 | driver_attach+0x24/0x30 | bus_add_driver+0xe4/0x1e8 | driver_register+0x60/0x128 | __platform_driver_register+0x28/0x34 | scmi_driver_init+0x84/0xc0 | do_one_initcall+0x78/0x33c | kernel_init_freeable+0x2b8/0x51c | kernel_init+0x24/0x130 | ret_from_fork+0x10/0x20 | Code: f0004701 910a0021 aa1403e5 97b91c70 (b9400280) | ---[ end trace 0000000000000000 ]---
Simply check for the struct pointer being NULL before trying to access its members, to avoid this situation.
This was found when a transport doesn't really work (for instance no SMC service), the probe routines then tries to clean up, and triggers a crash.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 17, 2024 |
| Suse | — | Upgrade kernel-debug-develUpgrade dlm-kmp-azureUpgrade dtb-armUpgrade dtb-renesasUpgrade kernel-azure-vdsoUpgrade kernel-debug-vdsoUpgrade dtb-nvidiaUpgrade kernel-rt-extraUpgrade dlm-kmp-rtUpgrade kernel-default-base-rebuildUpgrade kernel-docsUpgrade reiserfs-kmp-defaultUpgrade kernel-default-livepatch-develUpgrade kernel-default-baseUpgrade reiserfs-kmp-rtUpgrade kernel-azureUpgrade ocfs2-kmp-azureUpgrade cluster-md-kmp-64kbUpgrade dtb-mediatekUpgrade kernel-64kb-extraUpgrade reiserfs-kmp-azureUpgrade dtb-socionextUpgrade kernel-rt-develUpgrade kernel-defaultUpgrade kernel-syms-rtUpgrade cluster-md-kmp-defaultUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-rockchipUpgrade kselftests-kmp-rtUpgrade kselftests-kmp-defaultUpgrade dtb-sprdUpgrade kernel-rt_debugUpgrade dtb-amdUpgrade gfs2-kmp-defaultUpgrade kernel-debug-livepatch-develUpgrade kernel-rt-vdsoUpgrade kernel-devel-rtUpgrade dlm-kmp-defaultUpgrade kernel-obs-buildUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt-livepatch-develUpgrade kernel-symsUpgrade kernel-rtUpgrade kernel-source-vanillaUpgrade kernel-source-rtUpgrade kernel-kvmsmallUpgrade kernel-devel-azureUpgrade kernel-azure-extraUpgrade dtb-hisiliconUpgrade kernel-rt_debug-develUpgrade kernel-default-livepatchUpgrade kernel-default-develUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-lgUpgrade kernel-default-extraUpgrade dtb-apmUpgrade kernel-obs-qaUpgrade kernel-kvmsmall-vdsoUpgrade kernel-debugUpgrade cluster-md-kmp-rtUpgrade kernel-rt-livepatchUpgrade kernel-macrosUpgrade gfs2-kmp-azureUpgrade kselftests-kmp-azureUpgrade gfs2-kmp-rtUpgrade dtb-allwinnerUpgrade kernel-docs-htmlUpgrade kernel-zfcpdumpUpgrade dtb-broadcomUpgrade ocfs2-kmp-defaultUpgrade kselftests-kmp-64kbUpgrade kernel-default-vdsoUpgrade kernel-64kbUpgrade cluster-md-kmp-azureUpgrade kernel-64kb-develUpgrade gfs2-kmp-64kbUpgrade dtb-freescaleUpgrade reiserfs-kmp-64kbUpgrade kernel-rt-optionalUpgrade kernel-64kb-livepatch-develUpgrade kernel-syms-azureUpgrade kernel-kvmsmall-develUpgrade dtb-appleUpgrade kernel-default-optionalUpgrade kernel-azure-livepatch-develUpgrade dtb-amlogicUpgrade ocfs2-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-azure-develUpgrade dtb-qcomUpgrade kernel-sourceUpgrade dtb-xilinxUpgrade kernel-source-azureUpgrade kernel-azure-optionalUpgrade kernel-64kb-optionalUpgrade kernel-develUpgrade dtb-exynosUpgrade dtb-caviumUpgrade dtb-amazonUpgrade dtb-alteraUpgrade dlm-kmp-64kbUpgrade dtb-marvell | May 15, 2024 | Apr 17, 2024 |
| Ubuntu | — | Upgrade linux-image-kvmUpgrade linux-image-5.15.0-1038-xilinx-zynqmpUpgrade linux-image-5.15.0-125-lowlatency-64kUpgrade linux-image-6.8.0-35-genericUpgrade linux-image-5.15.0-125-generic-64kUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-6.8.0-1008-gcpUpgrade linux-image-5.15.0-1067-intel-iotgUpgrade linux-image-oem-24.04Upgrade linux-image-5.15.0-1078-azureUpgrade linux-image-5.15.0-125-genericUpgrade linux-image-5.15.0-1055-gkeopUpgrade linux-image-oem-20.04Upgrade linux-image-intel-iotgUpgrade linux-image-6.8.0-35-generic-64kUpgrade linux-image-6.8.0-35-lowlatencyUpgrade linux-image-6.8.0-1009-awsUpgrade linux-image-gkeUpgrade linux-image-awsUpgrade linux-image-intelUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-6.8.0-35-lowlatency-64kUpgrade linux-image-azure-cvmUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-5.15.0-125-lowlatencyUpgrade linux-image-5.15.0-125-generic-lpaeUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-6.8.0-1006-ibmUpgrade linux-image-oracleUpgrade linux-image-genericUpgrade linux-image-5.15.0-1072-awsUpgrade linux-image-6.8.0-1004-gkeUpgrade linux-image-virtualUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-gkeopUpgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1006-oemUpgrade linux-image-gke-5.15Upgrade linux-image-5.15.0-1067-nvidiaUpgrade linux-image-oracle-64kUpgrade linux-image-oem-20.04bUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-azure-lts-22.04Upgrade linux-image-gcpUpgrade linux-image-5.15.0-1067-nvidia-lowlatencyUpgrade linux-image-5.15.0-1065-raspiUpgrade linux-image-5.15.0-1069-gkeUpgrade linux-image-lowlatencyUpgrade linux-image-azure-fdeUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-5.15.0-1065-ibmUpgrade linux-image-oem-20.04cUpgrade linux-image-6.8.0-1006-oracle-64kUpgrade linux-image-5.15.0-1071-gcpUpgrade linux-image-aws-lts-22.04Upgrade linux-image-azureUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-1006-oracleUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-6.8.0-1008-azureUpgrade linux-image-5.15.0-1075-azureUpgrade linux-image-raspiUpgrade linux-image-oem-20.04dUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-1005-raspiUpgrade linux-image-gkeop-5.15Upgrade linux-image-5.15.0-1069-kvmUpgrade linux-image-generic-64kUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-5.15.0-1070-oracleUpgrade linux-image-generic-lpaeUpgrade linux-image-ibmUpgrade linux-image-nvidiaUpgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1008-azure-fde | Jul 1, 2024 | Apr 17, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 13, 2025 | Apr 17, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub