CVE-2026-90270

A flaw was found in the arm_mpam driver of the Linux kernel. A local user could trigger a use-after-free vulnerability by unbinding a Memory System Component (MSC) and then attempting to read the schemata file in the resctrl filesystem. This could lead to system instability or a denial of service.

A use-after-free flaw in the arm_mpam driver of the Linux kernel affects Red Hat Enterprise Linux 9 and 10 and Red Hat In-Vehicle OS 2 with Moderate impact (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). If a local user unbinds an MSC (Memory System Component) that is the last remaining MSC for a component, the corresponding mpam_component structure is freed; a subsequent read of the schemata file in the resctrl filesystem then dereferences that freed structure from resctrl_arch_get_config(), causing a use-after-free that can crash the kernel and result in a denial of service. The vulnerable code in drivers/resctrl/mpam_devices.c was introduced upstream in kernel 6.19, so Red Hat Enterprise Linux 6, 7, and 8 and the earlier Red Hat Enterprise Linux 9 and 10 update streams, whose kernels do not contain the vulnerable code, are not affected; OpenShift RHEL CoreOS images are likewise not affected. The affected Red Hat Enterprise Linux 9 and 10 streams and Red Hat In-Vehicle OS 2 kernel components are marked affected with the fix deferred to a later release. The residual risk of deferring is limited to local denial of service: only the availability of the system is impacted, and triggering the flaw requires deliberate use of the arm_mpam sysfs unbind interface, which is the only path that removes an MSC. The upstream fix removes the arm_mpam unbind sysfs interface entirely rather than attempting to support unbinding safely.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

A practical workaround is to avoid unbinding MPAM MSC (Memory System Component) devices through the arm_mpam driver's sysfs unbind interface. The upstream analysis states that, because the MPAM driver is not a module, this unbind interface is the only way to trigger the vulnerable removal path, so refraining from unbinding MSC devices prevents the use-after-free. The upstream fix removes the unbind interface altogether, so updating to a kernel release that includes the upstream fix also resolves the issue.