CVE-2026-90192

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: handle NULL data in send_data callback mailbox_clear_channel() calls mbox_send_message() with NULL data to notify the remote side that the RX channel has been cleared. qcom_cpucp_mbox_send_data() blindly dereferenced the data pointer, causing a NULL pointer dereference kernel panic when invoked from this path under PREEMPT_RT. Add an explicit NULL check and return early without writing to the TX register, which is the correct behaviour for a channel-clear notification.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-09-17 17:17:13.920000

Last modified

2026-10-19 09:19:09.227000

View original CVE JSON

{
  "id": "CVE-2026-90192",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-09-17T17:17:13.920",
  "lastModified": "2026-10-19T09:19:09.227",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: qcom-cpucp: handle NULL data in send_data callback\n\nmailbox_clear_channel() calls mbox_send_message() with NULL data to\nnotify the remote side that the RX channel has been cleared.\nqcom_cpucp_mbox_send_data() blindly dereferenced the data pointer,\ncausing a NULL pointer dereference kernel panic when invoked from\nthis path under PREEMPT_RT.\n\nAdd an explicit NULL check and return early without writing to the\nTX register, which is the correct behaviour for a channel-clear\nnotification."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/mailbox/qcom-cpucp-mbox.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "0e2a9a03106cd5fa0dbc9047675e7645c55e2669",
              "lessThan": "3d11d2a6c9a10de287e0f1b53a5e65d16afe2760",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "0e2a9a03106cd5fa0dbc9047675e7645c55e2669",
              "lessThan": "413b0b94d6d06b8d49735280e86a01dac90cf177",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "0e2a9a03106cd5fa0dbc9047675e7645c55e2669",
              "lessThan": "b3d73e7440e0c40644285be1bda349cdf90122d8",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "0e2a9a03106cd5fa0dbc9047675e7645c55e2669",
              "lessThan": "fc4f2f99530298a1739226947aa76525142d421d",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/mailbox/qcom-cpucp-mbox.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.11",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "6.11",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.110",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.52",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.6",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/3d11d2a6c9a10de287e0f1b53a5e65d16afe2760",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/413b0b94d6d06b8d49735280e86a01dac90cf177",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b3d73e7440e0c40644285be1bda349cdf90122d8",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fc4f2f99530298a1739226947aa76525142d421d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}