Executive brief
The Linux kernel's ARM Memory Partitioning and Monitoring (MPAM) driver can crash with a NULL pointer dereference if a user unbinds a Memory System Component (MSC) device after an error interrupt has disabled the driver. This causes unexpected system crashes and service interruptions on ARM-based systems using MPAM resource management.
Technical details
This vulnerability is a NULL pointer dereference in the arm_mpam MPAM MSC driver's remove callback (mpam_msc_drv_remove). The root cause is a race condition: when mpam_disable() runs in response to an error interrupt, it sets the driver's drvdata to NULL. If a user then unbinds the MSC device via sysfs, the remove callback attempts to dereference the NULL pointer without checking. The fix adds an early return check in the remove callback to return safely if msc is NULL. The attack vector requires local system access (ability to unbind devices). The patch was committed to the stable kernel tree in August 2026 and released in September 2026.
Affected products
- Linux Linux kernel multiple versions containing drivers/resctrl/mpam_devices.c (fixed in commit fc996c39689bb15aa80e5366809434f7258fb703)
Timeline
- 2026-09-17: disclosed: CVE-2026-90271 published
- 2026-08-06: patched: Fix committed by Ben Horgan
- 2026-09-14: patched: Fix released in stable kernel tree