{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "9ca67840c0ddf3f39407339624cef824a4f27599"
            },
            {
              "fixed": "c59b3393df1348a12308aaabd5fbc58ed6b21cf5"
            },
            {
              "fixed": "6abe8fe36b29ff51d1a42c2f338972883f4751a5"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "91ff1e9652fb9beb0174267d6bb38243dff211bb"
            },
            {
              "last_affected": "ff4273d47da81b95ed9396110bcbd1b7b7470fe8"
            },
            {
              "last_affected": "2fbf6c9695ad9f05e7e5c166bf43fac7cb3276b3"
            },
            {
              "last_affected": "969d8beaa2e374387bf9aa5602ef84fc50bb48d8"
            },
            {
              "last_affected": "8a8a3547d5c4960da053df49c75bf623827a25da"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "5.15.182"
            },
            {
              "fixed": "5.16"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6.1.138"
            },
            {
              "fixed": "6.2"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6.6.90"
            },
            {
              "fixed": "6.7"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6.12.28"
            },
            {
              "fixed": "6.13"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6.14.6"
            },
            {
              "fixed": "6.15"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.15.0"
            },
            {
              "fixed": "7.2.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93081.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Fix SCMI device destroy lifetimes\n\nscmi_child_dev_find() drops the reference returned by\ndevice_find_child() before returning the scmi_device pointer. A\nconcurrent unregister can then release the device while the destroy path\nis still using the returned pointer.\n\nMake the lookup helper return the device_find_child() reference and keep\nit until scmi_device_destroy() has finished unregistering the child.\n\nAlso split device_unregister() in __scmi_device_destroy() so the SCMI bus\nID is not made reusable until after device_del() has removed the old\nscmi_dev.N name from sysfs. This avoids a new SCMI device reusing the\nsame ID while the old device is still registered.\n\nThe final device release callback is also a possible cleanup path when\nSCMI children are deleted by driver core recursion rather than\n__scmi_device_destroy(). Release the SCMI bus ID from a common helper\nused by destroy, register-failure and final-release paths, and clear\nscmi_dev-\u003eid after freeing it so the final release cannot free the same\nID again.",
  "id": "CVE-2026-93081",
  "modified": "2026-09-19T03:31:00.394032994Z",
  "published": "2026-09-17T16:11:01.679Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6abe8fe36b29ff51d1a42c2f338972883f4751a5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c59b3393df1348a12308aaabd5fbc58ed6b21cf5"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93081.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93081"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "firmware: arm_scmi: Fix SCMI device destroy lifetimes"
}