CVE-2025-37905 firmware: arm_scmi: Balance device refcount when destroying devices

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Addressed in Firmware Security Updates Two security vulnerabilities in firmware have been reported, affecting ARM and Qualcomm devices. CVE-2025-37905, published on May 20, 2025, addresses device reference counting issues, while CVE-2024-57852, published on February 27, 2025, deals with missing SCM device handling. Both vulnerabilities have been acknowledged in recent publications. 2 sources 39