UBUNTU-CVE-2026-90271: Null Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved: armmpam: Fix a NULL pointer dereference on unbinding after an error interrupt If a user unbinds an MSC after mpamdisable() has been run in response to an error interrupt then a dereference of a NULL pointer occurs as mpamdisable() sets the drvdata to NULL. Add an early return to the driver remove callback to avoid this.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Add an early return to the arm_mpam driver remove callback when drvdata is NULL, preventing a NULL pointer dereference if an MSC is unbound after mpam_disable() runs in response to an error interrupt.
Event History
Frequently Asked Questions
What sequence is required to trigger the NULL pointer dereference?
An error interrupt must first cause mpam_disable() to run, which clears the driver's drvdata. A user must then unbind an MSC; the driver remove callback can dereference the now-NULL drvdata.
Which Ubuntu kernel packages are identified as affected?
The affected packages listed are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0.
What can be done if the corrected kernel is not yet available?
Avoid unbinding an MSC after an error interrupt has caused mpam_disable() to execute. The resolved change adds an early return in the driver remove callback when drvdata has been cleared.