Riskcovery

CVE-2026-90192

mailbox: qcom-cpucp: handle NULL data in send_data callback

State
Published
Severity
Not scored
Published
Sep 17, 2026
Updated
Oct 19, 2026
Reserved
Sep 11, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

mailbox: qcom-cpucp: handle NULL data in send_data callback

mailbox_clear_channel() calls mbox_send_message() with NULL data to notify the remote side that the RX channel has been cleared. qcom_cpucp_mbox_send_data() blindly dereferenced the data pointer, causing a NULL pointer dereference kernel panic when invoked from this path under PREEMPT_RT.

Add an explicit NULL check and return early without writing to the TX register, which is the correct behaviour for a channel-clear notification.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 0e2a9a03106cd5fa0dbc9047675e7645c55e2669 to before 3d11d2a6c9a10de287e0f1b53a5e65d16afe2760Affected
  • 0e2a9a03106cd5fa0dbc9047675e7645c55e2669 to before 413b0b94d6d06b8d49735280e86a01dac90cf177Affected
  • 0e2a9a03106cd5fa0dbc9047675e7645c55e2669 to before b3d73e7440e0c40644285be1bda349cdf90122d8Affected
  • 0e2a9a03106cd5fa0dbc9047675e7645c55e2669 to before fc4f2f99530298a1739226947aa76525142d421dAffected
LinuxLinux
  • 6.11Affected
  • before 6.11Not affected
  • 6.12.110 through 6.12.*Not affected
  • 6.18.52 through 6.18.*Not affected
  • 7.2.6 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.