CVE-2026-90271: arm_mpam: Fix a NULL pointer dereference on unbinding after an error interrupt
In the Linux kernel, the following vulnerability has been resolved:
armmpam: Fix a NULL pointer dereference on unbinding after an error interrupt
If a user unbinds an MSC after mpamdisable() has been run in response to an error interrupt then a dereference of a NULL pointer occurs as mpamdisable() sets the drvdata to NULL. Add an early return to the driver remove callback to avoid this.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Add an early return to the driver remove callback when mpam_disable() has set the driver data (drvdata) to NULL, preventing a NULL pointer dereference if an MSC is unbound after an error interrupt.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel arm_mpam driver and an MSC are affected when an MSC can be unbound after the driver has been disabled in response to an error interrupt.
What sequence triggers the NULL pointer dereference?
An error interrupt causes mpam_disable() to run and clear the driver's drvdata pointer. If a user then unbinds the MSC, the driver remove callback can dereference that NULL pointer.
What does the resolution change?
The fix adds an early return in the driver remove callback when the driver data has already been cleared, preventing the dereference during unbinding.