CVE-2026-23107
Null Pointer Dereference in Linux arm64 fpsimd ZA Context Restore
Publication date: 2026-02-04
Last updated on: 2026-03-19
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 6.2 (inc) to 6.6.122 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.68 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.8 (exc) |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 5.19 (inc) to 6.1.162 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's arm64/fpsimd signal handling code related to the SSVE (Scalable Vector Extension) storage allocation when restoring the ZA (SVE/SSVE register state). The issue occurs because the code does not allocate the task's sve_state before setting the TIF_SME flag. This can cause a task to enter an invalid state where TIF_SME is set but sve_state is NULL.
In uncommon cases, such as when a task is saved and restored using tools like CRIU, the ZA signal context may not have been created by the kernel for the same task, so sve_state might not have been allocated. This allows userspace to enter streaming mode without trapping, even though sve_state is NULL, which leads to a NULL pointer dereference in the kernel when it tries to store the register state, causing a kernel crash (Oops).
The fix ensures that restore_za_context() allocates the task's sve_state properly, preserving any live SVE/SSVE state restored earlier, preventing the invalid state and subsequent kernel crash.
How can this vulnerability impact me? :
This vulnerability can cause a kernel NULL pointer dereference leading to a kernel crash (Oops) on affected Linux systems running on arm64 architecture with SSVE support. This crash can result in denial of service by making the system unstable or unresponsive.
In scenarios where tasks are checkpointed and restored (e.g., using CRIU), this vulnerability could be triggered, potentially disrupting normal system operation and causing unexpected reboots or downtime.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability manifests as a kernel NULL pointer dereference related to the arm64/fpsimd signal handling when restoring ZA context. Detection involves observing kernel logs for specific error messages or oops traces indicating a NULL pointer dereference in sve_save_state or fpsimd_save_user_state functions.
You can check your system logs (e.g., using dmesg or journalctl) for kernel oops messages similar to the following pattern:
- dmesg | grep -i 'Unable to handle kernel NULL pointer dereference'
- journalctl -k | grep -i 'Oops: 0000000096000046'
Additionally, monitoring for crashes or faults related to fpsimd or sve_save_state in kernel logs can help detect this issue.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by ensuring that the task's sve_state is properly allocated when restoring the ZA context in the Linux kernel. Immediate mitigation involves updating the Linux kernel to a version that includes this fix.
Until the kernel is updated, avoid using or restoring ZA signal contexts in ways that could trigger this issue, such as using checkpoint/restore tools like CRIU that save and restore tasks with ZA contexts.
Monitoring kernel updates and applying patches promptly is the recommended course of action.