CVE-2026-90192
Description
In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: handle NULL data in send_data callback mailbox_clear_channel() calls mbox_send_message() with NULL data to notify the remote side that the RX channel has been cleared. qcom_cpucp_mbox_send_data() blindly dereferenced the data pointer, causing a NULL pointer dereference kernel panic when invoked from this path under PREEMPT_RT. Add an explicit NULL check and return early without writing to the TX register, which is the correct behaviour for a channel-clear notification.
How to fix
- Linux Linux3d11d2a6c9a10de287e0f1b53a5e65d16afe2760, 413b0b94d6d06b8d49735280e86a01dac90cf177, b3d73e7440e0c40644285be1bda349cdf90122d8, fc4f2f99530298a1739226947aa76525142d421d or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 0e2a9a03106cd5fa0dbc9047675e7645c55e2669 ≤ v < 3d11d2a6c9a10de287e0f1b53a5e65d16afe2760, 0e2a9a03106cd5fa0dbc9047675e7645c55e2669 ≤ v < 413b0b94d6d06b8d49735280e86a01dac90cf177, 0e2a9a03106cd5fa0dbc9047675e7645c55e2669 ≤ v < b3d73e7440e0c40644285be1bda349cdf90122d8, 0e2a9a03106cd5fa0dbc9047675e7645c55e2669 ≤ v < fc4f2f99530298a1739226947aa76525142d421d, 6.11 | 3d11d2a6c9a10de287e0f1b53a5e65d16afe2760, 413b0b94d6d06b8d49735280e86a01dac90cf177, b3d73e7440e0c40644285be1bda349cdf90122d8, fc4f2f99530298a1739226947aa76525142d421d |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.