CVE-2026-23348
Race Condition in Linux Kernel cxl_nvdimm Causes NULL Pointer Dereference
Publication date: 2026-03-25
Last updated on: 2026-04-24
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 5.14 |
| linux | linux_kernel | From 6.19 (inc) to 6.19.7 (exc) |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 5.14.1 (inc) to 6.18.17 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-362 | The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's cxl (Compute Express Link) subsystem, specifically involving a race condition with the nvdimm_bus object when creating nvdimm devices.
The issue occurs because the cxl_translate module depends on cxl_acpi, and when cxl_acpi is removed, orphaned nvdimm objects attempt to reprobe. During this process, the nvdimm_bus object, which should be registered by the cxl_nvb object during cxl_acpi_probe(), may be missing.
If the nvdimm_bus object is missing, the function __nd_device_register() tries to access a NULL pointer (dev->parent pointing to &nvdimm_bus->dev), causing a kernel NULL pointer dereference and a crash.
The fix involves ensuring synchronous probing of the cxl_nvb driver, adding checks to confirm the driver is attached, locking mechanisms to validate nvdimm_bus, and marking cxl_nvdimm devices as invalidated to prevent orphaned devices from probing after the nvdimm_bus is removed.
How can this vulnerability impact me? :
This vulnerability can cause a kernel NULL pointer dereference, leading to a kernel crash (kernel panic) or system instability.
Such crashes can result in denial of service, where the affected system becomes unresponsive or requires a reboot.
In environments relying on the cxl subsystem and nvdimm devices, this could disrupt normal operations, potentially causing data loss or downtime.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability manifests as a kernel NULL pointer dereference related to the cxl and nvdimm_bus objects in the Linux kernel. Detection can be done by monitoring kernel logs for specific error messages indicating this issue.
- Check kernel logs for messages similar to: "BUG: kernel NULL pointer dereference, address: 000000000000006c".
- Look for call traces involving cxl_core, cxl_pmem, and libnvdimm modules, especially functions like __nd_device_register, cxl_nvdimm_probe, and cxl_bus_probe.
- Use the command: dmesg | grep -i 'NULL pointer dereference' to filter relevant kernel messages.
- Monitor for errors during the execution of cxl-translate.sh unit test or similar tests that exercise the cxl_translate module.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves applying the patch that fixes the race condition in the cxl and nvdimm_bus object handling in the Linux kernel.
- Ensure the cxl_nvb driver is probed synchronously by setting probe_type to PROBE_FORCE_SYNCHRONOUS.
- Add checks to ensure the cxl_nvb driver is attached during cxl_acpi_probe.
- Take appropriate locks (cxl_root uport_dev lock and cxl_nvb->dev lock) before validating nvdimm_bus.
- Set the cxl_nvdimm flag to CXL_NVD_F_INVALIDATED so that cxl_nvdimm_probe exits with -EBUSY, preventing orphaned device probing.
Removing cxl_nvdimm devices prevents orphaned devices from reprobe after cxl_acpi removal, which is part of the fix.