CVE-2026-23019 Linux CVE debrief

Who should care

Linux kernel developers and users who rely on the Marvell Prestera driver should be aware of this vulnerability and take steps to mitigate it. This includes applying the available patches to fix the vulnerability, using a supported Linux kernel version that includes the fix, and monitoring system logs for signs of exploitation.

Technical summary

The vulnerability is caused by a NULL pointer dereference in the prestera_devlink_alloc() function. The devlink_alloc() function may return NULL on allocation failure, but the prestera_devlink_alloc() function does not check for this condition before calling devlink_priv() on the returned pointer. This can lead to a NULL pointer dereference and a system crash. The affected versions of the Linux kernel are 5.10.1 to 5.15.198, 5.16 to 6.1.161, 6.2 to 6.6.121, 6.7 to 6.12.66, and 6.13 to 6.18.6.

Defensive priority

Medium-High

Recommended defensive actions

• Apply the available patches to fix the vulnerability
• Use a supported Linux kernel version that includes the fix
• Monitor system logs for signs of exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was resolved in the Linux kernel through a series of patches. Limited evidence suggests that this vulnerability may be exploited in the wild, but defenders should verify affected deployments and review system logs for signs of exploitation. Additional verification is recommended due to limited source detail.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.