Executive brief
A component of the Linux kernel that manages inter-processor communication (mailbox) on Microchip RISC-V systems could crash if memory allocation fails. The code did not check whether a function call succeeded before using its result, potentially causing the kernel to attempt to use a null pointer and crash, affecting system stability.
Technical details
The vulnerability is a missing null pointer check in the mchp_ipc_get_cluster_aggr_irq() function in the Linux kernel's mailbox driver (drivers/mailbox/mailbox-mchp-ipc-sbi.c). The devm_kasprintf() function can fail and return NULL under low-memory conditions, but the code did not validate the return value before dereferencing it. An attacker with the ability to trigger memory pressure on the system could cause allocation failure, leading to null pointer dereference and kernel crash (denial of service). The fix adds a simple null check that returns -ENOMEM if devm_kasprintf() fails. The patch is available in the Linux kernel stable tree.
Affected products
- Linux Linux kernel Linux 5.0 and later (mailbox mchp-ipc-sbi driver)
Timeline
- 2026-09-04: disclosed