CVE-2026-23433

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23433", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:46.016Z", "datePublished": "2026-04-03T15:15:18.757Z", "dateUpdated": "2026-05-11T22:06:48.863Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:06:48.863Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm_mpam: Fix null pointer dereference when restoring bandwidth counters\n\nWhen an MSC supporting memory bandwidth monitoring is brought offline and\nthen online, mpam_restore_mbwu_state() calls __ris_msmon_read() via ipi to\nrestore the configuration of the bandwidth counters. It doesn't care about\nthe value read, mbwu_arg.val, and doesn't set it leading to a null pointer\ndereference when __ris_msmon_read() adds to it. This results in a kernel\noops with a call trace such as:\n\nCall trace:\n__ris_msmon_read+0x19c/0x64c (P)\nmpam_restore_mbwu_state+0xa0/0xe8\nsmp_call_on_cpu_callback+0x1c/0x38\nprocess_one_work+0x154/0x4b4\nworker_thread+0x188/0x310\nkthread+0x11c/0x130\nret_from_fork+0x10/0x20\n\nProvide a local variable for val to avoid __ris_msmon_read() dereferencing\na null pointer when adding to val."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/resctrl/mpam_devices.c"], "versions": [{"version": "41e8a14950e1732af51cfec8fa09f8ded02a5ca9", "lessThan": "ac3e12bc195786d3d44d730b5b2259fd36191848", "status": "affected", "versionType": "git"}, {"version": "41e8a14950e1732af51cfec8fa09f8ded02a5ca9", "lessThan": "4ad79c874e53ebb7fe3b8ae7ac6c858a2121f415", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/resctrl/mpam_devices.c"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.10", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ac3e12bc195786d3d44d730b5b2259fd36191848"}, {"url": "https://git.kernel.org/stable/c/4ad79c874e53ebb7fe3b8ae7ac6c858a2121f415"}], "title": "arm_mpam: Fix null pointer dereference when restoring bandwidth counters", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/resctrl/mpam_devices.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ac3e12bc195786d3d44d730b5b2259fd36191848", "status": "affected", "version": "41e8a14950e1732af51cfec8fa09f8ded02a5ca9", "versionType": "git"}, {"lessThan": "4ad79c874e53ebb7fe3b8ae7ac6c858a2121f415", "status": "affected", "version": "41e8a14950e1732af51cfec8fa09f8ded02a5ca9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/resctrl/mpam_devices.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D70DEFFE-AC47-4F3A-A2B2-2D67AB4CF3C8", "versionEndExcluding": "6.19.10", "versionStartIncluding": "6.19.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*", "matchCriteriaId": "35C8A871-4971-433E-A046-FC9F7B7D190A", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm_mpam: Fix null pointer dereference when restoring bandwidth counters\n\nWhen an MSC supporting memory bandwidth monitoring is brought offline and\nthen online, mpam_restore_mbwu_state() calls __ris_msmon_read() via ipi to\nrestore the configuration of the bandwidth counters. It doesn't care about\nthe value read, mbwu_arg.val, and doesn't set it leading to a null pointer\ndereference when __ris_msmon_read() adds to it. This results in a kernel\noops with a call trace such as:\n\nCall trace:\n__ris_msmon_read+0x19c/0x64c (P)\nmpam_restore_mbwu_state+0xa0/0xe8\nsmp_call_on_cpu_callback+0x1c/0x38\nprocess_one_work+0x154/0x4b4\nworker_thread+0x188/0x310\nkthread+0x11c/0x130\nret_from_fork+0x10/0x20\n\nProvide a local variable for val to avoid __ris_msmon_read() dereferencing\na null pointer when adding to val."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\narm_mpam: Correcci\u00f3n de desreferencia de puntero nulo al restaurar contadores de ancho de banda\n\nCuando un MSC que soporta la monitorizaci\u00f3n de ancho de banda de memoria se desconecta y luego se conecta, mpam_restore_mbwu_state() llama a __ris_msmon_read() a trav\u00e9s de ipi para restaurar la configuraci\u00f3n de los contadores de ancho de banda. No le importa el valor le\u00eddo, mbwu_arg.val, y no lo establece, lo que lleva a una desreferencia de puntero nulo cuando __ris_msmon_read() le a\u00f1ade. Esto resulta en un kernel oops con un rastro de llamada como:\n\nRastro de llamada:\n__ris_msmon_read+0x19c/0x64c (P)\nmpam_restore_mbwu_state+0xa0/0xe8\nsmp_call_on_cpu_callback+0x1c/0x38\nprocess_one_work+0x154/0x4b4\nworker_thread+0x188/0x310\nkthread+0x11c/0x130\nret_from_fork+0x10/0x20\n\nProporcionar una variable local para val para evitar que __ris_msmon_read() desreferencie un puntero nulo al a\u00f1adir a val."}], "id": "CVE-2026-23433", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-04-03T16:16:24.777", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4ad79c874e53ebb7fe3b8ae7ac6c858a2121f415"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ac3e12bc195786d3d44d730b5b2259fd36191848"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: arm_mpam: Fix null pointer dereference when restoring bandwidth counters", "id": "2454833", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454833"}, "csaw": false, "cwe": "CWE-476", "details": ["A flaw was found in the Linux kernel's arm_mpam component. A local user with privileges to manage hardware components could trigger a null pointer dereference when a Memory System Controller (MSC) supporting memory bandwidth monitoring is brought offline and then online. This vulnerability, occurring in the `__ris_msmon_read()` function, causes a kernel oops, leading to a system crash and a Denial of Service (DoS)."], "name": "CVE-2026-23433", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23433\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23433\nhttps://lore.kernel.org/linux-cve-announce/2026040311-CVE-2026-23433-01be@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[41e8a14950e1732af51cfec8fa09f8ded02a5ca9,ac3e12bc195786d3d44d730b5b2259fd36191848)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[41e8a14950e1732af51cfec8fa09f8ded02a5ca9,4ad79c874e53ebb7fe3b8ae7ac6c858a2121f415)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.10,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T21:49:04.101872+00:00", "value": {"mitigation_remediation": ["Update the Linux kernel to a version that includes the mpam_restore_mbwu_state fix commit (4ad79c874e53ebb7fe3b8ae7ac6c858a2121f415) or later.", "If a pre\u2011built kernel cannot be replaced, patch the kernel source by applying the commit and rebuild the kernel.", "If the system can tolerate it, disable the ARM MPAM subsystem (CONFIG_ARM_MPAM) in the kernel configuration to prevent the faulty restore routine from executing."], "summary": {"action": "Apply Patch", "impact": "Kernel Crash (Denial of Service)"}, "threat_synthesis": {"affected_systems": "All Linux kernel builds that include the ARM MPAM subsystem and support MSC bandwidth monitoring are vulnerable unless the fix commit has been applied. The CPE data lists a broad range of kernel versions (from 6.19 and all 7.0-rc releases), implying that any kernel containing MPAM without the patch is affected.", "description_and_impact": "In the ARM MPAM subsystem of the Linux kernel, a null pointer dereference occurs when a Media Storage Controller that monitors memory bandwidth is taken offline and then brought back online. The restore routine fails to initialize a local variable for the counter value, causing __ris_msmon_read to dereference a NULL pointer and trigger a kernel oops. The resulting crash forces a reboot and can disrupt system availability.", "risk_and_exploitability": "The CVSS score of 5.5 indicates moderate severity, and the EPSS score of < 1% suggests a very low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog. Because the trigger requires control of the MSC offline/online cycle, the attack vector is limited to local privileged or hardware-level access. The impact is a denial of service via kernel crash, with no evidence of further privileges or data exposure."}}}}, "created": "2026-04-03T21:14:05.049260+00:00", "updated": "2026-04-28T22:00:14.114858+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}