CVE-2026-90192: mailbox: qcom-cpucp: handle NULL data in send_data callback
In the Linux kernel, the following vulnerability has been resolved:
mailbox: qcom-cpucp: handle NULL data in senddata callback
mailboxclearchannel() calls mboxsendmessage() with NULL data to notify the remote side that the RX channel has been cleared. qcomcpucpmboxsenddata() blindly dereferenced the data pointer, causing a NULL pointer dereference kernel panic when invoked from this path under PREEMPTRT.
Add an explicit NULL check and return early without writing to the TX register, which is the correct behaviour for a channel-clear notification.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this panic?
Systems using the Linux kernel qcom-cpucp mailbox driver are exposed when the channel-clear path invokes its send_data callback with NULL data. The described panic occurs under PREEMPT_RT.
What triggers the failure?
The failure is triggered when mailbox_clear_channel() sends a NULL data pointer as a channel-clear notification. The qcom-cpucp send callback dereferences that pointer, causing a kernel NULL pointer dereference and panic.
What does the fix change?
The fix adds an explicit NULL check in qcom_cpucp_mbox_send_data(). For a channel-clear notification, it returns without writing to the TX register.