CVE-2026-90192

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: handle NULL data in send_data callback mailbox_clear_channel() calls mbox_send_message() with NULL data to notify the remote side that the RX channel has been cleared. qcom_cpucp_mbox_send_data() blindly dereferenced the data pointer, causing a NULL pointer dereference kernel panic when invoked from this path under PREEMPT_RT. Add an explicit NULL check and return early without writing to the TX register, which is the correct behaviour for a channel-clear notification.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/3d11d2a6c9a10de287e0f1b53a5e65d16afe2760
https://git.kernel.org/stable/c/413b0b94d6d06b8d49735280e86a01dac90cf177
https://git.kernel.org/stable/c/b3d73e7440e0c40644285be1bda349cdf90122d8
https://git.kernel.org/stable/c/fc4f2f99530298a1739226947aa76525142d421d

Configurations

No configuration.

History

17 Sep 2026, 17:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-17 17:17

Updated : 2026-09-17 17:17

NVD link : CVE-2026-90192

Mitre link : CVE-2026-90192

CVE.ORG link : CVE-2026-90192

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-90192", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "0e2a9a03106cd5fa0dbc9047675e7645c55e2669", "lessThan": "3d11d2a6c9a10de287e0f1b53a5e65d16afe2760", "versionType": "git"}, {"status": "affected", "version": "0e2a9a03106cd5fa0dbc9047675e7645c55e2669", "lessThan": "413b0b94d6d06b8d49735280e86a01dac90cf177", "versionType": "git"}, {"status": "affected", "version": "0e2a9a03106cd5fa0dbc9047675e7645c55e2669", "lessThan": "b3d73e7440e0c40644285be1bda349cdf90122d8", "versionType": "git"}, {"status": "affected", "version": "0e2a9a03106cd5fa0dbc9047675e7645c55e2669", "lessThan": "fc4f2f99530298a1739226947aa76525142d421d", "versionType": "git"}], "programFiles": ["drivers/mailbox/qcom-cpucp-mbox.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"status": "unaffected", "version": "0", "lessThan": "6.11", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.110", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.52", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.2.6", "versionType": "semver", "lessThanOrEqual": "7.2.*"}, {"status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/mailbox/qcom-cpucp-mbox.c"], "defaultStatus": "affected"}]}], "published": "2026-09-17T17:17:13.920", "references": [{"url": "https://git.kernel.org/stable/c/3d11d2a6c9a10de287e0f1b53a5e65d16afe2760", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/413b0b94d6d06b8d49735280e86a01dac90cf177", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b3d73e7440e0c40644285be1bda349cdf90122d8", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/fc4f2f99530298a1739226947aa76525142d421d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: qcom-cpucp: handle NULL data in send_data callback\n\nmailbox_clear_channel() calls mbox_send_message() with NULL data to\nnotify the remote side that the RX channel has been cleared.\nqcom_cpucp_mbox_send_data() blindly dereferenced the data pointer,\ncausing a NULL pointer dereference kernel panic when invoked from\nthis path under PREEMPT_RT.\n\nAdd an explicit NULL check and return early without writing to the\nTX register, which is the correct behaviour for a channel-clear\nnotification."}], "lastModified": "2026-09-17T17:17:13.920", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}