CVE-2026-23438 Linux CVE debrief

Who should care

Users of Linux kernel versions 5.12.1 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.20, 6.19 to 6.19.10, and 7.0 rc1 to rc7 should apply patches to mitigate this vulnerability. System administrators and security teams responsible for Linux kernel-based systems should review their deployments and apply the necessary patches.

Technical summary

The mvpp2_bm_switch_buffers() function unconditionally calls mvpp2_bm_pool_update_priv_fc() when switching between per-cpu and shared buffer pool modes. However, this function does not check if priv->cm3_base is NULL before dereferencing it, leading to a NULL pointer dereference. The fix is to add a priv->global_tx_fc guard to both the disable and re-enable calls in mvpp2_bm_switch_buffers(), consistent with the rest of the driver. This fix prevents the NULL pointer dereference and ensures the stability of the Linux kernel.

Defensive priority

Medium

Recommended defensive actions

• Apply patches from Linux kernel stable branches
• Inventory and update affected Linux kernel versions
• Monitor for MTU changes that may trigger the vulnerability
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-04-03T16:16:25.540Z and last modified on 2026-07-14T13:18:34.257Z. The NVD entry is currently Modified. The Linux kernel's mvpp2 driver has a NULL pointer dereference vulnerability when the CM3 SRAM resource is not present in the device tree. This can cause a crash when the mvpp2_bm_switch_buffers() function is triggered. Users should verify their Linux kernel versions and apply patches if necessary.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.