Executive brief
The Linux kernel's ARM MPAM (Memory Partitioning and Monitoring) driver contains a use-after-free vulnerability where unbinding the last MSC (Memory System Controller) device causes the component object to be freed. Subsequent access to the resctrl filesystem's schemata file triggers a crash or potential memory corruption. This vulnerability allows local attackers with sysfs access to cause kernel crashes or potentially execute code.
Technical details
The vulnerability is a use-after-free (CWE-416) in the ARM MPAM driver's resource control (resctrl) subsystem. When a user unbinds an MSC device via sysfs that is the last MSC for a given component, the corresponding mpam_component structure is freed. If the user then reads the schemata file in the resctrl filesystem, the already-freed mpam_component is accessed from resctrl_arch_get_config(), resulting in a use-after-free. The attack vector is local sysfs access (requires root or equivalent permissions). The fix disables the driver unbind sysfs interface by setting suppress_bind_attrs to true in the platform driver structure, preventing the triggering condition entirely.
Affected products
- Linux Linux kernel affected versions through upstream commit bb1a0f582d519c0461b0940116e2b52c5ba31459 (2026-08-07)
Timeline
- 2026-08-06: other: Patch authored by Ben Horgan
- 2026-08-07: other: Upstream commit bb1a0f582d519c0461b0940116e2b52c5ba31459 merged
- 2026-09-17: disclosed