The Linux kernel's arm_mpam subsystem had a vulnerability where __destroy_component_cfg() would dereference a NULL pointer if called before the configuration array was allocated. This occurs because __destroy_component_cfg() frees the configuration array and associated mbwu_state without verifying allocation. If mpam_disable() calls __destroy_component_cfg() prematurely, it leads to a NULL pointer dereference. The fix involves checking whether the configuration array is allocated before freeing it, preventing the NULL dereference.

This vulnerability can cause a denial of service (DoS) by crashing the kernel due to a NULL pointer dereference. There is no impact on confidentiality or integrity. The attack vector requires local privileges with low complexity and no user interaction, making it a moderate risk in environments where local access is possible.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid invoking mpam_disable() in contexts where the configuration array may not have been allocated. Monitor vendor channels for updates and apply official patches once released.