CVE-2026-53278: Linux ARM MPAM Null Pointer Dereference DoS Vulnerability

Technical summary

CVE-2026-53278 is a null pointer dereference (CWE-476) in the ARM MPAM implementation within the Linux kernel. The vulnerable function __destroy_component_cfg() is responsible for deallocating configuration arrays via an embedded 'garbage' structure field, which assumes the array pointer is valid. However, if mpam_disable() calls __destroy_component_cfg() before __allocate_component_cfg() has completed execution, the comp->cfg pointer remains NULL. The function then dereferences this null pointer without validation, triggering a kernel panic. The mbwu_state allocation dependency is sequenced after comp->cfg assignment under the mpam_list_lock, so checking only the primary pointer is sufficient to gate the destruction operation safely.

Business impact

This vulnerability enables local denial-of-service attacks against systems running affected Linux kernel versions. An unprivileged local user can crash the kernel by triggering premature component destruction, rendering services unavailable. Systems relying on ARM MPAM for resource partitioning in high-availability or multi-tenant environments face operational disruption risk. Recovery requires manual intervention and system restart. The attack surface is limited to systems where MPAM is active and users have local access, reducing enterprise exposure for most workloads, but cloud providers and containerized environments may face customer impact.

Affected systems

The vulnerability affects the Linux kernel specifically in its ARM MPAM subsystem implementation. This component is present in mainline kernel versions and is primarily relevant to ARM-based systems that utilize memory partitioning and monitoring features. The exact affected kernel version range is not specified in the advisory; verify against the official Linux kernel security advisories and your distribution's patch tracking for specific affected versions and backport status.

Exploitability

Exploitation requires local system access with unprivileged user privileges. An attacker must be able to execute code or trigger system calls that initiate MPAM component destruction during an uninitialized state. The vulnerability is not remotely exploitable and does not permit privilege escalation or information disclosure. The CVSS 3.1 score of 5.5 (MEDIUM) reflects the local-only attack vector, low complexity, and availability-only impact. This vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Remediation

The fix involves adding a null pointer check in __destroy_component_cfg() before attempting to dereference the config array. The patched function validates that comp->cfg is not NULL before proceeding with the destruction sequence. This ensures the function safely returns early if called in an uninitialized state, preventing the dereference. Apply the available kernel security patch from your Linux distribution or upstream kernel maintainers as soon as practicable.

Patch guidance

Identify your current kernel version using 'uname -r' and cross-reference against your distribution's security advisory and kernel release notes. Most major distributions (Red Hat, Debian, Ubuntu, SUSE, etc.) have published or will publish patched kernel versions addressing CVE-2026-53278. Prioritize patches for ARM-based systems actively using MPAM features. Test patches in non-production environments first, as kernel updates require system restart. If MPAM is not in use on your systems, apply patches during your normal maintenance window; if MPAM is active, consider accelerated patching to mitigate availability risk.

Detection guidance

Monitor kernel logs (dmesg, journalctl) for null pointer dereference messages mentioning arm_mpam or __destroy_component_cfg(). Look for kernel panic logs with stack traces referencing the MPAM subsystem. Systems experiencing unexpected kernel crashes during shutdown or component reconfiguration may indicate exploitation attempts or environmental triggering. Kernel panic dumps will show the faulting instruction within the vulnerable function. Correlate crash timing with administrative actions on MPAM-configured resources. Tools like systemd-journal or centralized logging can aggregate these signals across multiple systems.

Why prioritize this

While this is a local-only vulnerability with medium severity, it poses a direct availability threat to ARM systems running MPAM. Organizations operating ARM-based infrastructure (embedded systems, edge computing, ARM servers) should prioritize patching to prevent denial-of-service. For environments where MPAM is not explicitly enabled or used, this may be lower priority but should still be addressed during normal patch cycles. The low CVSS score should not minimize importance in ARM-heavy deployments.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects: local attack vector (AV:L, requiring authenticated system access), low attack complexity (AC:L, easily triggered), low privilege requirement (PR:L, unprivileged user), no user interaction needed (UI:N), system scope unchanged (S:U), and no confidentiality or integrity impact (C:N/I:N) but high availability impact (A:H, complete service disruption). The score appropriately captures that while impact is severe within scope, exploitability is constrained to local attackers, keeping it in the MEDIUM range rather than HIGH.

Frequently asked questions