CVE-2026-23433 arm_mpam: Fix null pointer dereference when restoring bandwidth counters
A null pointer dereference in the Linux kernel's ARM MPAM driver causes a kernel oops and denial of service when restoring bandwidth counters.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23433?
CVE-2026-23433 is a medium-severity vulnerability in Linux kernel, published on 3 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
arm_mpam: Fix null pointer dereference when restoring bandwidth counters
When an MSC supporting memory bandwidth monitoring is brought offline and then online, mpam_restore_mbwu_state() calls __ris_msmon_read() via ipi to restore the configuration of the bandwidth counters. It doesn't care about the value read, mbwu_arg.val, and doesn't set it leading to a null pointer dereference when __ris_msmon_read() adds to it. This results in a kernel oops with a call trace such as:
Call trace: __ris_msmon_read+0x19c/0x64c (P) mpam_restore_mbwu_state+0xa0/0xe8 smp_call_on_cpu_callback+0x1c/0x38 process_one_work+0x154/0x4b4 worker_thread+0x188/0x310 kthread+0x11c/0x130 ret_from_fork+0x10/0x20
Provide a local variable for val to avoid __ris_msmon_read() dereferencing a null pointer when adding to val.
Weakness: CWE-476
Which versions are affected by CVE-2026-23433?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23433?
Apply the vendor's patch.
Is CVE-2026-23433 being exploited?
There is no known exploitation of CVE-2026-23433 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2026-23433, GHSA-vqqw-285r-pw6x, UBUNTU-CVE-2026-23433.