« Volver al listado

CVE-2026-90192

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

mailbox: qcom-cpucp: handle NULL data in send_data callback

mailbox_clear_channel() calls mbox_send_message() with NULL data to notify the remote side that the RX channel has been cleared. qcom_cpucp_mbox_send_data() blindly dereferenced the data pointer, causing a NULL pointer dereference kernel panic when invoked from this path under PREEMPT_RT.

Add an explicit NULL check and return early without writing to the TX register, which is the correct behaviour for a channel-clear notification.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-90192",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "0e2a9a03106cd5fa0dbc9047675e7645c55e2669",
              "lessThan": "3d11d2a6c9a10de287e0f1b53a5e65d16afe2760",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0e2a9a03106cd5fa0dbc9047675e7645c55e2669",
              "lessThan": "413b0b94d6d06b8d49735280e86a01dac90cf177",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0e2a9a03106cd5fa0dbc9047675e7645c55e2669",
              "lessThan": "b3d73e7440e0c40644285be1bda349cdf90122d8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0e2a9a03106cd5fa0dbc9047675e7645c55e2669",
              "lessThan": "fc4f2f99530298a1739226947aa76525142d421d",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/mailbox/qcom-cpucp-mbox.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.11",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/mailbox/qcom-cpucp-mbox.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-17T17:17:13.920",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/3d11d2a6c9a10de287e0f1b53a5e65d16afe2760",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/413b0b94d6d06b8d49735280e86a01dac90cf177",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b3d73e7440e0c40644285be1bda349cdf90122d8",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fc4f2f99530298a1739226947aa76525142d421d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: qcom-cpucp: handle NULL data in send_data callback\n\nmailbox_clear_channel() calls mbox_send_message() with NULL data to\nnotify the remote side that the RX channel has been cleared.\nqcom_cpucp_mbox_send_data() blindly dereferenced the data pointer,\ncausing a NULL pointer dereference kernel panic when invoked from\nthis path under PREEMPT_RT.\n\nAdd an explicit NULL check and return early without writing to the\nTX register, which is the correct behaviour for a channel-clear\nnotification."
    }
  ],
  "lastModified": "2026-09-17T17:17:13.920",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}