---
id: CVE-2026-53278
title: 'arm_mpam: Check whether the config array is allocated before destroying it'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  arm_mpam: Check whether the config array is allocated before destroying it

  __destroy_component_cfg() is called to free the configuration array.
  It uses the embedded 'g…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 3bd04fe7d807bbdcfe75b29ca82fae4e2d7dc524 <
    8eb6dc76eeae5302c0d885906a0e469ef9630a59
  - >-
    Linux >= 3bd04fe7d807bbdcfe75b29ca82fae4e2d7dc524 <
    6ccbb613b42a1f1ba7bfd547a148f644a902a25c
  - Linux 6.19
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:24:52.648474Z'
published: '2026-06-26'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:34:17.220Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-53278'
references:
  - url: 'https://git.kernel.org/stable/c/8eb6dc76eeae5302c0d885906a0e469ef9630a59'
  - url: 'https://git.kernel.org/stable/c/6ccbb613b42a1f1ba7bfd547a148f644a902a25c'
tags:
  - cve.org
epss: 0.00143
epssPercentile: 0.03653
ingestedAt: '2026-11-06T16:57:43.258Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

arm_mpam: Check whether the config array is allocated before destroying it

__destroy_component_cfg() is called to free the configuration array.
It uses the embedded 'garbage' structure, which means the array has
to be allocated.

If __destroy_component_cfg() is called from mpam_disable() before the
configuration was ever allocated, then a NULL pointer is dereferenced.

Check for this case and return early if the configuration is not
allocated.

__destroy_component_cfg() also frees the mbwu_state as this is allocated
by __allocate_component_cfg(). As the mbwu_state is allocated after
comp->cfg is set, and is also under mpam_list_lock, only the first
pointer needs checking.

## Affected

- `Linux >= 3bd04fe7d807bbdcfe75b29ca82fae4e2d7dc524 < 8eb6dc76eeae5302c0d885906a0e469ef9630a59`
- `Linux >= 3bd04fe7d807bbdcfe75b29ca82fae4e2d7dc524 < 6ccbb613b42a1f1ba7bfd547a148f644a902a25c`
- `Linux 6.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.