CVE-2026-90271: arm_mpam: Fix a NULL pointer dereference on unbinding after an error interrupt
In the Linux kernel, the following vulnerability has been resolved:
armmpam: Fix a NULL pointer dereference on unbinding after an error interrupt
If a user unbinds an MSC after mpamdisable() has been run in response to an error interrupt then a dereference of a NULL pointer occurs as mpamdisable() sets the drvdata to NULL. Add an early return to the driver remove callback to avoid this.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel arm_mpam driver and an MSC are affected when an MSC can be unbound after the driver has been disabled in response to an error interrupt.
What sequence triggers the NULL pointer dereference?
An error interrupt causes mpam_disable() to run and clear the driver's drvdata pointer. If a user then unbinds the MSC, the driver remove callback can dereference that NULL pointer.
What does the resolution change?
The fix adds an early return in the driver remove callback when the driver data has already been cleared, preventing the dereference during unbinding.