CVE-2026-90270: arm_mpam: Disable driver unbind to avoid UAF
In the Linux kernel, the following vulnerability has been resolved:
armmpam: Disable driver unbind to avoid UAF
When a user unbinds an MSC and that MSC is the only MSC left for a component then the corresponding mpamcomponent will be freed. If the user then goes on to read the schemata file in the resctrl filesystem then the mpamcomponent will be accessed from resctrlarchgetconfig() leading to a use after free.
As the MPAM driver is not a module the unbind sysfs interface is the only way to trigger the remove. Instead of dealing with the complexity of allowing some unused MSC to unbind just remove the unbind sysfs interface.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the MPAM driver unbind sysfs interface (since MPAM driver is not a module, unbind sysfs is the only way to trigger removal that can lead to UAF).
Linux kernel MPAM (arm_mpam) sysfs unbind interface = disabled
Event History
Frequently Asked Questions
What conditions are required to trigger the use-after-free?
A user must unbind an MSC through its sysfs interface when it is the only MSC remaining for its component, then read the schemata file in the resctrl filesystem. The unbind frees the associated mpam_component, which the later schemata read can access.
Is ordinary driver removal or module unloading required?
No. The MPAM driver is not a module, and the sysfs unbind interface is described as the only way to trigger its remove path.
What mitigation is implemented by the resolution?
The resolution removes the driver unbind sysfs interface. This prevents users from unbinding MSCs and reaching the freeing condition described for the vulnerability.