CVE-2026-23433: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-23433 is a NULL pointer dereference vulnerability in the Linux kernel's arm_mpam subsystem that can cause a kernel oops and denial of service. It affects Linux kernel versions 6.19.1 through 6.19.9 and 7.0-rc1 through 7.0-rc4, specifically on ARM-based systems with MPAM (Memory Partitioning and Monitoring)-capable processors. The vulnerability was published on April 3, 2026, with patches available in kernel 6.19.10 and 7.0-rc5. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory).

The root cause is a NULL pointer dereference (CWE-476) in the mpam_restore_mbwu_state() function within the Linux kernel's arm_mpam subsystem. When a Memory System Component (MSC) supporting memory bandwidth monitoring is brought offline and then back online via CPU hotplug, mpam_restore_mbwu_state() calls __ris_msmon_read() via inter-processor interrupt (IPI) to restore bandwidth counter configuration. The function fails to initialize mbwu_arg.val before passing it to __ris_msmon_read(), which then attempts to dereference and add to this uninitialized (null) pointer, triggering a kernel oops. The fix involves providing a local variable for val so that __ris_msmon_read() has a valid pointer to write to (GitHub Advisory).

Successful exploitation results in a kernel oops and immediate system crash, causing a denial of service. A local user with low privileges can trigger this condition by performing CPU hotplug operations (taking a processor offline and bringing it back online) on an affected ARM system with MPAM-capable hardware. There is no impact on confidentiality or data integrity — the sole consequence is availability loss through an unrecoverable kernel crash (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires local access with low privileges and is only triggerable on ARM-based systems with MPAM-capable processors during CPU hotplug operations, limiting its practical attack surface. The EPSS score is approximately 0.018–0.019%, indicating a very low probability of exploitation in the near term (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

• Logs: Kernel oops messages in system logs (dmesg, /var/log/kern.log) containing the call trace: __ris_msmon_read+0x19c/0x64c, mpam_restore_mbwu_state+0xa0/0xe8, smp_call_on_cpu_callback+0x1c/0x38, process_one_work+0x154/0x4b4.
• System Behavior: Unexpected system crashes or kernel panics on ARM MPAM-capable systems coinciding with CPU hotplug events (CPU online/offline operations).

Upgrade to Linux kernel version 6.19.10 or later (for the 6.19.x stable series), or to 7.0-rc5 or later (for 7.0 release candidates). Patch commits are available at git.kernel.org (commits 4ad79c874e53ebb7fe3b8ae7ac6c858a2121f415 and ac3e12bc195786d3d44d730b5b2259fd36191848). As a temporary workaround on systems where patching is not immediately possible, avoiding CPU hotplug operations (disabling dynamic CPU online/offline management) on ARM MPAM-capable systems can prevent triggering the vulnerability (GitHub Advisory).