CVE-2026-23438
NULL Pointer Dereference in Linux mvpp2 Driver Causes Kernel Crash
Publication date: 2026-04-03
Last updated on: 2026-04-23
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 5.12 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.2 (inc) to 6.6.130 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.167 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.78 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.20 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 6.19.10 (exc) |
| linux | linux_kernel | From 5.12.1 (inc) to 5.15.203 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's mvpp2 network driver, specifically in the function mvpp2_bm_switch_buffers(). This function switches between per-CPU and shared buffer pool modes and calls mvpp2_bm_pool_update_priv_fc() without checking if a critical pointer (priv->cm3_base) is NULL.
If the CM3 SRAM resource is missing from the device tree, priv->cm3_base remains NULL and priv->global_tx_fc is false. When mvpp2_bm_switch_buffers() is triggered, for example by changing the MTU across the jumbo frame threshold, the kernel dereferences this NULL pointer, causing a crash.
The vulnerability is due to missing a guard check (priv->global_tx_fc) before accessing hardware registers, which other parts of the driver correctly implement. The fix adds this missing guard to prevent the NULL pointer dereference.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to crash due to a NULL pointer dereference when certain network buffer operations occur, such as changing the MTU size across the jumbo frame threshold.
A kernel crash leads to a denial of service (DoS) condition, making the affected system unstable or unavailable until it is rebooted.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is caused by the mvpp2_bm_switch_buffers() function unconditionally calling mvpp2_bm_pool_update_priv_fc() without checking if priv->global_tx_fc is true, which can lead to a NULL pointer dereference and kernel crash.
To mitigate this vulnerability, ensure that the missing guard check for priv->global_tx_fc is added to the disable and re-enable calls in mvpp2_bm_switch_buffers(), consistent with the rest of the driver.
This typically involves updating the Linux kernel to a version where this fix is applied or applying the patch that adds the missing guard.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability causes a kernel crash due to a NULL pointer dereference when certain operations trigger mvpp2_bm_switch_buffers(), such as changing the MTU across the jumbo frame threshold.
Detection can involve monitoring for kernel crash logs or oops messages indicating a NULL pointer dereference related to mvpp2_cm3_read or mvpp2_bm_switch_buffers.
Specifically, look for kernel messages containing lines like "Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000" and call traces referencing mvpp2_cm3_read, mvpp2_bm_pool_update_priv_fc, or mvpp2_bm_switch_buffers.
Since no specific detection commands or tools are provided in the context or resources, general Linux commands to check kernel logs can be used, such as:
- dmesg | grep -i 'mvpp2_cm3_read'
- journalctl -k | grep -i 'NULL pointer dereference'
- grep -i 'mvpp2_bm_switch_buffers' /var/log/kern.log
Additionally, monitoring for MTU changes on affected network interfaces might help identify triggering events.