CVE-2026-90192

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

mailbox: qcom-cpucp: handle NULL data in send_data callback

mailbox_clear_channel() calls mbox_send_message() with NULL data to notify the remote side that the RX channel has been cleared. qcom_cpucp_mbox_send_data() blindly dereferenced the data pointer, causing a NULL pointer dereference kernel panic when invoked from this path under PREEMPT_RT.

Add an explicit NULL check and return early without writing to the TX register, which is the correct behaviour for a channel-clear notification.

Live-patch status from KernelCare for each operating system.