CVE-2026-53278: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-53278 is a NULL pointer dereference vulnerability in the Linux kernel's arm_mpam subsystem. It occurs when __destroy_component_cfg() is called from mpam_disable() before the configuration array has ever been allocated, causing a kernel NULL pointer dereference. The vulnerability affects Linux kernel version 6.19 and specific git commit ranges starting from 3bd04fe7d807bbdcfe75b29ca82fae4e2d7dc524. It was published on June 26, 2026, with patches available shortly after. The CVSS v3.1 base score is 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-909 (Missing Initialization of Resource) and estimated as CWE-476 (NULL Pointer Dereference). The __destroy_component_cfg() function uses an embedded garbage structure to free the configuration array, which requires the array to have been previously allocated. When mpam_disable() invokes this function before __allocate_component_cfg() has run, comp->cfg is NULL, and the subsequent dereference causes a kernel panic. The fix adds an early-return NULL check on comp->cfg before any dereference occurs; since mbwu_state is allocated after comp->cfg is set and is protected under mpam_list_lock, only the first pointer requires checking (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation results in a kernel NULL pointer dereference, causing a system crash or kernel panic — a Denial of Service (DoS) impact. There is no confidentiality or integrity impact, as the vulnerability only affects availability. The affected scope is limited to systems running ARM hardware with the MPAM (Memory Partitioning and Monitoring) subsystem enabled, and exploitation requires local access with sufficient privileges to trigger mpam_disable() (GitHub Advisory, Red Hat Bugzilla).

Patches have been committed to the Linux kernel stable tree. The fixes are available at commits 8eb6dc76eeae5302c0d885906a0e469ef9630a59 and 6ccbb613b42a1f1ba7bfd547a148f644a902a25c in the kernel stable repository. Versions 7.0.10 and 7.1 (and later) are unaffected. Administrators should update to a patched kernel version; as a temporary workaround, disabling or avoiding use of the ARM MPAM subsystem on affected systems may reduce exposure (GitHub Advisory, Red Hat Bugzilla).