CVE-2026-23019: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23019 is a NULL pointer dereference vulnerability in the Linux kernel's Marvell Prestera network driver (net/marvell/prestera). The flaw exists because prestera_devlink_alloc() unconditionally calls devlink_priv() on the pointer returned by devlink_alloc() without first checking whether the allocation succeeded, leading to a kernel crash if allocation fails. Affected kernel versions include 5.10.x through 5.15.197, 5.16.x through 6.1.160, 6.2.x through 6.6.120, 6.7.x through 6.12.65, and 6.13.x through 6.18.5. The vulnerability was published on January 31, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is classified as CWE-476 (NULL Pointer Dereference). When the kernel's devlink_alloc() function fails to allocate memory and returns NULL, the prestera_devlink_alloc() function in the Marvell Prestera driver proceeds to call devlink_priv() on the NULL pointer without any guard check, causing a kernel panic. The attack vector is local, requiring low privileges and no user interaction — an attacker or unprivileged process that can trigger memory pressure or driver initialization on a system with the Prestera driver loaded could induce the failure condition. The fix adds a NULL check on the return value of devlink_alloc() and returns NULL early to prevent the dereference (Feedly, Kernel Patch).

Successful exploitation results in a kernel NULL pointer dereference, causing a denial-of-service (DoS) condition via a system crash (kernel panic). The impact is limited to availability — there is no confidentiality or integrity compromise. The vulnerability affects only systems running the Marvell Prestera network driver, limiting the scope to hardware environments using Marvell Prestera-based switching ASICs (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (Feedly). The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges, further limiting practical risk.

Update the Linux kernel to a patched version corresponding to your current branch: 5.15.198 or later, 6.1.161 or later, 6.6.121 or later, 6.12.66 or later, or 6.18.6 or later. Patch commits are available at the upstream stable kernel repository. If immediate patching is not possible, consider disabling or blacklisting the prestera kernel module (modprobe -r prestera) on systems that do not require Marvell Prestera hardware support. Ubuntu security notices USN-8278-1, USN-8289-1, USN-8296-1, and their follow-up updates also address this vulnerability (Ubuntu USN-8278-1, Ubuntu USN-8289-1, Ubuntu USN-8296-1, Red Hat CVE).