Executive brief
The Linux kernel's QCOM CPUCP mailbox driver did not properly handle NULL data pointers passed during channel-clear operations, causing kernel panics. This affects systems using QCOM platforms with the CPUCP mailbox controller and can result in service disruption or system crashes.
Technical details
The vulnerability is a NULL pointer dereference in the qcom_cpucp_mbox_send_data() callback function. The mailbox_clear_channel() function legitimately calls mbox_send_message() with NULL data to signal channel closure to the remote side, but the QCOM driver's send_data callback blindly dereferenced the data pointer without validation. Under PREEMPT_RT (real-time preemption), this dereference triggered a kernel panic. The fix adds an explicit NULL check to return early when data is NULL, which is the correct behavior for channel-clear notifications. The patch has been merged into the Linux stable kernel.
Affected products
- Linux Linux Kernel multiple versions (fixed in stable branches)
Timeline
- 2026-09-17: disclosed: Published on NVD
- 2026-09-14: patched: Patch committed to stable kernel tree by Greg Kroah-Hartman