CVE-2026-90192

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference occurs in the qcom cpucp mbox send data() function when it is invoked via the mailbox clear channel() function under PREEMPT RT. The issue arises because mailbox clear channel() calls mbox send message() with NULL data to notify the remote side that the RX channel has been cleared, but the qcom cpucp mbox send data() function dereferences the data pointer without validation, leading to a kernel panic.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.