CVE-2026-31544

Summary

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_scmi: Fix NULL dereference on notify error path

Since commit b5daf93b809d1 ("firmware: arm_scmi: Avoid notifier registration for unsupported events") the call chains leading to the helper __scmi_event_handler_get_ops expect an ERR_PTR to be returned on failure to get an handler for the requested event key, while the current helper can still return a NULL when no handler could be found or created.

Fix by forcing an ERR_PTR return value when the handler reference is NULL.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxb5daf93b809d13a194f8a8eeacfab1cfa241bbc3 < 70d9bd9a2e683afe6200b0c20af22f06f1a199a4affected
LinuxLinuxb5daf93b809d13a194f8a8eeacfab1cfa241bbc3 < 8414d2800c34528467df23ce6192c254a73e4459affected
LinuxLinuxb5daf93b809d13a194f8a8eeacfab1cfa241bbc3 < 555317d6100164748f7d09f80142739bd29f0cdaaffected
LinuxLinux6.17affected
LinuxLinux0 < 6.17unaffected
LinuxLinux6.18.20 <= 6.18.*unaffected
LinuxLinux6.19.10 <= 6.19.*unaffected
LinuxLinux7.0 <= *unaffected

Weaknesses

References