CVE-2026-90270

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: arm_mpam: Disable driver unbind to avoid UAF When a user unbinds an MSC and that MSC is the only MSC left for a component then the corresponding mpam_component will be freed. If the user then goes on to read the schemata file in the resctrl filesystem then the mpam_component will be accessed from resctrl_arch_get_config() leading to a use after free. As the MPAM driver is not a module the unbind sysfs interface is the only way to trigger the remove. Instead of dealing with the complexity of allowing some unused MSC to unbind just remove the unbind sysfs interface.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-09-17 17:17:23.573000

Last modified

2026-10-19 09:19:20.603000

View original CVE JSON

{
  "id": "CVE-2026-90270",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-09-17T17:17:23.573",
  "lastModified": "2026-10-19T09:19:20.603",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm_mpam: Disable driver unbind to avoid UAF\n\nWhen a user unbinds an MSC and that MSC is the only MSC left for a\ncomponent then the corresponding mpam_component will be freed. If the user\nthen goes on to read the schemata file in the resctrl filesystem then the\nmpam_component will be accessed from resctrl_arch_get_config() leading to a\nuse after free.\n\nAs the MPAM driver is not a module the unbind sysfs interface is the only\nway to trigger the remove. Instead of dealing with the complexity of\nallowing some unused MSC to unbind just remove the unbind sysfs interface."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/resctrl/mpam_devices.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "f04046f2577a5c76167333ca99d3903ee5331ba0",
              "lessThan": "7d199b6a0651abad3ca6d0877dbedbe8fe6ea9e2",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "f04046f2577a5c76167333ca99d3903ee5331ba0",
              "lessThan": "bb1a0f582d519c0461b0940116e2b52c5ba31459",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/resctrl/mpam_devices.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.19",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "6.19",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.6",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/7d199b6a0651abad3ca6d0877dbedbe8fe6ea9e2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/bb1a0f582d519c0461b0940116e2b52c5ba31459",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}