CVE-2026-68345

Received Received - Intake

arm_mpam NULL Pointer Dereference in Linux Kernel

Publication date: 2026-08-10

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: arm_mpam: guard MBWU state before adding it to garbage __destroy_component_cfg() adds each RIS mbwu_state object to the MPAM garbage list when destroying component configuration. However, mbwu_state is allocated per RIS and only for RISes with MBWU monitors. A component can therefore have comp->cfg allocated while some RISes still have ris->mbwu_state set to NULL. Passing a NULL mbwu_state to add_to_garbage() dereferences the NULL pointer inside the macro. Skip RISes that do not have an mbwu_state object before adding them to the garbage list.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-17

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68345

EUVD

EUVD-2026-55446

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a NULL pointer dereference vulnerability in the Linux kernel's arm_mpam component. When destroying component configuration, the code attempts to add RIS mbwu_state objects to a garbage list without checking if mbwu_state is NULL. This can cause a crash when the NULL pointer is dereferenced inside the add_to_garbage() macro.

Detection Guidance

This vulnerability is specific to the Linux kernel's arm_mpam component and may not have direct detection commands. Monitor kernel logs for NULL pointer dereference errors related to arm_mpam or MPAM garbage collection. Check for crashes or hangs during component destruction or configuration changes.

Impact Analysis

This vulnerability could cause a kernel crash or instability on affected systems using the arm_mpam feature. This may lead to denial of service conditions where the system becomes unresponsive or requires a reboot.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel memory management issue that could lead to system instability or crashes but does not involve data exposure or privacy violations typical of compliance concerns.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. If patches are unavailable, avoid using systems with arm_mpam enabled or disable the MBWU monitor feature in affected components. Monitor for NULL pointer dereference errors in kernel logs as a sign of exploitation.

Hi! I’m here to help you understand CVE-2026-68345. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70