CVE-2026-90270 arm_mpam: Disable driver unbind to avoid UAF
A local attacker with high privileges can trigger a use-after-free in the Linux kernel MPAM driver by unbinding an MSC, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90270?
CVE-2026-90270 is an use after free vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
arm_mpam: Disable driver unbind to avoid UAF
When a user unbinds an MSC and that MSC is the only MSC left for a component then the corresponding mpam_component will be freed. If the user then goes on to read the schemata file in the resctrl filesystem then the mpam_component will be accessed from resctrl_arch_get_config() leading to a use after free.
As the MPAM driver is not a module the unbind sysfs interface is the only way to trigger the remove. Instead of dealing with the complexity of allowing some unused MSC to unbind just remove the unbind sysfs interface.
Which versions are affected by CVE-2026-90270?
How do I fix CVE-2026-90270?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-90270 being exploited?
There is no known exploitation of CVE-2026-90270 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-90270, GHSA-w5mj-8cp5-g38h, UBUNTU-CVE-2026-90270.