CVE-2026-90271

What it actually does

NULL pointer dereference in the arm_mpam driver remove callback when unbinding an MSC after mpam_disable() has already set drvdata to NULL following an error interrupt, resulting in a kernel crash.

Why it matters to the business

Systems running affected Linux kernels on ARM platforms with MPAM support may experience unexpected crashes or instability during error recovery or device unbind operations, leading to downtime and potential loss of availability.

How an attack unfolds

An attacker with local access triggers an error interrupt to invoke mpam_disable(), then performs an unbind operation on the MSC device to force the remove callback into dereferencing the now-NULL drvdata pointer.

How to fix it

Update the Linux kernel to a version containing the early return in the driver remove callback for arm_mpam; apply the fix from the referenced commit or later stable releases.

How to confirm the fix worked

Confirm the presence of the early return check in the mpam driver remove function in the running kernel source or binary; test unbind operations after simulated error interrupts.

Typical attack path

1. Trigger error interrupt in arm_mpam subsystem
2. Invoke mpam_disable() which clears drvdata
3. Perform MSC unbind to execute remove callback
4. Trigger NULL dereference causing kernel panic or oops

How to detect it

Review kernel logs for arm_mpam NULL pointer dereference oops occurring after error interrupts; look for device unbind events in dmesg or syslog around crash times.

What your security team should do

• Prioritize kernel updates for ARM MPAM-enabled systems within standard patch cycles given low EPSS
• Monitor kernel logs for arm_mpam related oops or NULL dereference messages
• Restrict unprivileged access to device unbind operations where feasible