CVE-2026-90270
Description
A flaw was found in the arm_mpam driver of the Linux kernel. A local user could trigger a use-after-free vulnerability by unbinding a Memory System Component (MSC) and then attempting to read the schemata file in the resctrl filesystem. This could lead to system instability or a denial of service.
Statement
A use-after-free flaw in the arm_mpam driver of the Linux kernel affects Red Hat Enterprise Linux 9 and 10 and Red Hat In-Vehicle OS 2 with Moderate impact (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). If a local user unbinds an MSC (Memory System Component) that is the last remaining MSC for a component, the corresponding mpam_component structure is freed; a subsequent read of the schemata file in the resctrl filesystem then dereferences that freed structure from resctrl_arch_get_config(), causing a use-after-free that can crash the kernel and result in a denial of service. The vulnerable code in drivers/resctrl/mpam_devices.c was introduced upstream in kernel 6.19, so Red Hat Enterprise Linux 6, 7, and 8 and the earlier Red Hat Enterprise Linux 9 and 10 update streams, whose kernels do not contain the vulnerable code, are not affected; OpenShift RHEL CoreOS images are likewise not affected. The affected Red Hat Enterprise Linux 9 and 10 streams and Red Hat In-Vehicle OS 2 kernel components are marked affected with the fix deferred to a later release. The residual risk of deferring is limited to local denial of service: only the availability of the system is impacted, and triggering the flaw requires deliberate use of the arm_mpam sysfs unbind interface, which is the only path that removes an MSC. The upstream fix removes the arm_mpam unbind sysfs interface entirely rather than attempting to support unbinding safely.
Mitigation
A practical workaround is to avoid unbinding MPAM MSC (Memory System Component) devices through the arm_mpam driver's sysfs unbind interface. The upstream analysis states that, because the MPAM driver is not a module, this unbind interface is the only way to trigger the vulnerable removal path, so refraining from unbinding MSC devices prevents the use-after-free. The upstream fix removes the unbind interface altogether, so updating to a kernel release that includes the upstream fix also resolves the issue.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory
If the expired pointer is used in a read operation, an attacker might be able to control data read in by the application.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
If the expired pointer references a memory location that is not accessible to the product, or points to a location that is "malformed" (such as NULL) or larger than expected by a read or write operation, then a crash may occur.
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
If the expired pointer is used in a function call, or points to unexpected data in a write operation, then code execution may be possible.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
