CVE-2026-23348: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23348 is a race condition vulnerability in the Linux kernel's CXL (Compute Express Link) subsystem that can cause a NULL pointer dereference, leading to a kernel crash. The flaw was discovered during execution of the cxl-translate.sh unit test and disclosed on March 25, 2026. It affects Linux kernel versions from 5.14.1 up to (but not including) 6.18.17, versions 6.19.x before 6.19.7, and Linux kernel 7.0 release candidates (rc1–rc7). It carries a CVSS v3.1 base score of 4.7 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability is classified under CWE-362 (Race Condition) and CWE-820 (Missing Synchronization). It arises in the CXL subsystem when the cxl_translate module, which depends on cxl_acpi, causes orphaned nvdimm objects to reprobe after cxl_acpi is removed. The nvdimm_bus object — registered by cxl_nvb during cxl_acpi_probe() — may be absent when __nd_device_register() is called, causing it to dereference a NULL dev->parent pointer (pointing to &nvdimm_bus->dev) inside kobject_get(). The fix involves enforcing synchronous probing of cxl_nvb, adding a validity check for the nvdimm_bus object under appropriate locks, and setting the CXL_NVD_F_INVALIDATED flag to prevent orphaned devices from probing after the bus is removed (Red Hat Bugzilla, Kernel Patch 1).

Successful exploitation results in a kernel NULL pointer dereference, causing a system crash and complete denial of service (DoS). Only availability is impacted — there is no effect on confidentiality or integrity. The vulnerability is specifically relevant to systems using CXL memory technology or persistent memory (nvdimm) subsystems with the cxl_acpi and cxl_pmem drivers active (Red Hat Advisory).

Update the Linux kernel to version 6.18.17 or later, or 6.19.7 or later, which contain the race condition fix. Three upstream patch commits are available: 5b230daeee420833287cc77314439903e5312f10, 5fc4e150c5ada5f7d20d8f9f1b351f10481fbdf7, and 96a1fd0d84b17360840f344826897fa71049870e. Given the medium CVSS score and low EPSS, patching can be incorporated into regular maintenance cycles unless the system actively uses CXL/nvdimm functionality in production (Red Hat Bugzilla, Kernel Patch 1).