CVE-2026-89512

Received Received - Intake

remoteproc SCP device reference leak in Linux kernel

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: remoteproc: scp: Fix device reference leak on failed lookup Make sure to drop the reference taken to the SCP device when attempting to look up its driver data before the driver has been bound. Note that holding a reference to a device does not prevent its driver data from going away.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89512

EUVD

EUVD-2026-76418

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a device reference leak in the remoteproc subsystem, specifically in the SCP (System Control Processor) component. When attempting to look up driver data for the SCP device before its driver is bound, a reference to the device is taken but not properly released if the lookup fails. This can lead to a resource leak where the device's reference count remains elevated unnecessarily.

Detection Guidance

This vulnerability is specific to the Linux kernel's remoteproc subsystem and involves a device reference leak in the SCP (System Control Processor) driver. Detection requires checking for kernel logs or errors related to remoteproc or SCP device handling. Use commands like dmesg | grep remoteproc or journalctl -k | grep remoteproc to inspect kernel logs for warnings or errors.

Impact Analysis

The impact of this vulnerability is primarily on system stability and resource management. A leaked device reference could prevent the device from being properly released, potentially causing memory leaks or other resource exhaustion issues over time. This may lead to degraded system performance or unexpected behavior in systems relying on the remoteproc subsystem.

Mitigation Strategies

Apply the latest kernel update provided by your Linux distribution to patch this vulnerability. If an update is not immediately available, consider disabling the remoteproc SCP driver if it is not required for your system. Monitor kernel logs for any signs of the issue after applying mitigations.

Hi! I’m here to help you understand CVE-2026-89512. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70