Executive brief
A vulnerability in the Linux kernel's ARM Memory System Resource Partitioning and Monitoring (MPAM) driver can cause a system crash. This occurs when certain hardware components responsible for monitoring memory bandwidth are toggled between offline and online states. An exploit could lead to a complete system outage (kernel panic), impacting service availability.
Technical details
A NULL pointer dereference exists in the arm_mpam driver within the mpam_restore_mbwu_state() function. When a Memory System Controller (MSC) supporting bandwidth monitoring is brought back online, the function calls __ris_msmon_read() via an Inter-Processor Interrupt (IPI) to restore counter configurations. However, it fails to initialize the 'val' pointer in the mon_read structure. When __ris_msmon_read() attempts to write to or increment this uninitialized pointer, it triggers a kernel oops. This issue was introduced in the bandwidth counter state tracking for power management and has been patched in stable releases 6.19.10 and 7.0.
Affected products
- Linux Linux Kernel 6.19 through 6.19.9, 7.0-rc1 through 7.0-rc7
Timeline
- 2026-03-06: other: Patch authored
- 2026-04-03: disclosed: CVE published
- 2026-03-25: patched: Fix committed to stable tree