CVE-2026-90192

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mailbox: qcom-cpucp: handle NULL data in send_data callback

mailbox_clear_channel() calls mbox_send_message() with NULL data to

notify the remote side that the RX channel has been cleared.

qcom_cpucp_mbox_send_data() blindly dereferenced the data pointer,

causing a NULL pointer dereference kernel panic when invoked from

this path under PREEMPT_RT.

Add an explicit NULL check and return early without writing to the

TX register, which is the correct behaviour for a channel-clear

notification.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References