CVE-2026-90193

This CVE affects the qcom-cpucp mailbox driver in the Linux kernel under PREEMPT_RT configurations. The root cause is a lock re-entrancy deadlock : qcom_cpucp_mbox_irq_fn() invokes mbox_chan_received_data() while holding chan->lock. Under PREEMPT_RT, spin_lock_irqsave() is converted to an rt_s...

EUVD-2026-81786

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: fix PREEMPTRT self-deadlock in IRQ handler qcomcpucpmboxirqfn calls mboxchanreceiveddata while holding chan-lock. Under PREEMPTRT, spinlockirqsave is converted to an rtspinlock rtmutex-based, which tracks...

EUVD-2026-81785

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: handle NULL data in senddata callback mailboxclearchannel calls mboxsendmessage with NULL data to notify the remote side that the RX channel has been cleared. qcomcpucpmboxsenddata blindly dereferenced the da...

CVE-2026-90192

CVE-2026-90192 affects the Linux kernel 's Qualcomm qcom-cpucp mailbox driver. The root cause is a NULL pointer dereference in qcom_cpucp_mbox_send_data(), which blindly dereferenced the data pointer when mailbox_clear_channel() invoked mbox_send_message() with NULL data to signal an RX channel c...