Not yet scoredPublished Sep 11, 2026

CVE-2026-89512remoteproc: scp: Fix device reference leak on failed lookup

Updated under an hour ago (Oct 28, 2026, 6:50 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: remoteproc: scp: Fix device reference leak on failed lookup Make sure to drop the reference taken to the SCP device when attempting to look up its driver data before the driver has been bound. Note that holding a reference to a device does not prevent its driver data from going away.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 63c13d61eafe4606f1c16c54da40c4eee78e9edf before f1c9512ae072996647fb829c6402348d1b72af39; from 63c13d61eafe4606f1c16c54da40c4eee78e9edf before d6ef9060775483bcf57291cbacbc0fe89b5857da; from 63c13d61eafe4606f1c16c54da40c4eee78e9edf before 554689ff2d7561d91011e69a8bfcef1b71901b2b; 63c13d61eafe4606f1c16c54da40c4eee78e9edf builds before 6ca338cf2d386fd701b2dc27a2cd4c067a45d545; from 63c13d61eafe4606f1c16c54da40c4eee78e9edf before f794c930d8238e370fd61fcb12cc301ae098231b; from 63c13d61eafe4606f1c16c54da40c4eee78e9edf before c7e32814a6bf20f792d05f0bc9f94f0606311bc6; from 63c13d61eafe4606f1c16c54da40c4eee78e9edf before 440bcb0948a12c9104b6dcca99a2cfb0db49b22a; 63c13d61eafe4606f1c16c54da40c4eee78e9edf builds before 22f9efb3ae07f966a1901d929d16df1388cce65c	CNA record

References

References

https://git.kernel.org/stable/c/f1c9512ae072996647fb829c6402348d1b72af39
https://git.kernel.org/stable/c/d6ef9060775483bcf57291cbacbc0fe89b5857da
https://git.kernel.org/stable/c/554689ff2d7561d91011e69a8bfcef1b71901b2b
https://git.kernel.org/stable/c/6ca338cf2d386fd701b2dc27a2cd4c067a45d545
https://git.kernel.org/stable/c/f794c930d8238e370fd61fcb12cc301ae098231b
https://git.kernel.org/stable/c/c7e32814a6bf20f792d05f0bc9f94f0606311bc6
https://git.kernel.org/stable/c/440bcb0948a12c9104b6dcca99a2cfb0db49b22a
https://git.kernel.org/stable/c/22f9efb3ae07f966a1901d929d16df1388cce65c

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.