CVE-2026-23438: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23438 is a NULL pointer dereference vulnerability in the Linux kernel's mvpp2 (Marvell PP2) network driver that can cause a kernel crash and denial of service. The flaw exists in mvpp2_bm_switch_buffers(), which unconditionally calls mvpp2_bm_pool_update_priv_fc() without checking whether priv->cm3_base is NULL — a condition that occurs when the CM3 SRAM resource is absent from the device tree. Affected kernel versions include 5.12 through 5.15.x (before 5.15.203), 5.16 through 6.1.x (before 6.1.167), 6.2 through 6.6.x (before 6.6.130), 6.7 through 6.12.x (before 6.12.78), 6.13 through 6.18.x (before 6.18.20), and 6.19.x (before 6.19.10). It was published on April 3, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Github Advisory).

The root cause is a missing NULL pointer check (CWE-476) in the mvpp2_bm_switch_buffers() function of the Linux kernel's net/ethernet/marvell/mvpp2 driver. When switching between per-CPU and shared buffer pool modes, the function calls mvpp2_bm_pool_update_priv_fc(), which in turn invokes mvpp2_cm3_read()/mvpp2_cm3_write() to program CM3 flow control registers — both of which dereference priv->cm3_base without any NULL guard. On hardware where the CM3 SRAM memory is not declared in the device tree (i.e., the third reg entry introduced by commit 60523583b07c), priv->cm3_base remains NULL and priv->global_tx_fc is false. Any operation that crosses the jumbo frame MTU threshold triggers mvpp2_change_mtu() → mvpp2_bm_switch_buffers(), resulting in an immediate kernel NULL pointer dereference and crash, as evidenced by the call trace: readl → mvpp2_cm3_read → mvpp2_bm_pool_update_fc → mvpp2_bm_pool_update_priv_fc → mvpp2_bm_switch_buffers → mvpp2_change_mtu. All other flow control call sites in the driver already guard hardware access with priv->global_tx_fc or port->tx_fc; this path was the sole exception (Github Advisory).

Successful exploitation causes a kernel NULL pointer dereference, crashing the affected system and resulting in a complete denial of service. The impact is limited to availability — there is no confidentiality or integrity impact. Systems running Marvell PP2 network interfaces without the CM3 SRAM resource in their device tree are vulnerable to a crash triggered by routine network operations such as MTU changes, making this particularly relevant for embedded and networking appliances based on Marvell CP110/CP115 SoCs (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires local access with low privileges (e.g., the ability to issue ioctl calls to change network interface MTU), limiting its attack surface to local users or processes on affected systems. The EPSS score is approximately 0.018–0.024%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Identify a vulnerable target: Locate a system running a Marvell PP2 (mvpp2) network interface with a Linux kernel version in the affected range (e.g., 5.16–6.1.166) and without the CM3 SRAM resource configured in the device tree (i.e., priv->cm3_base is NULL and priv->global_tx_fc is false).
2. Gain local access: Obtain a local shell or process execution context on the target system with at least low-privilege user access sufficient to invoke network ioctl calls.
3. Trigger MTU change across jumbo frame threshold: Issue an MTU change on the affected network interface that crosses the jumbo frame boundary (e.g., changing MTU from a standard value below 1500 to above 1500, or vice versa) using a command such as ip link set <iface> mtu 9000 or via a raw SIOCSIFMTU ioctl.
4. Kernel crash occurs: The MTU change triggers mvpp2_change_mtu() → mvpp2_bm_switch_buffers() → mvpp2_bm_pool_update_priv_fc() → mvpp2_cm3_read(), which dereferences the NULL priv->cm3_base, causing an immediate kernel panic and system crash (Github Advisory).

• Logs: Kernel panic messages in dmesg or system logs containing Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 with a call trace including readl, mvpp2_cm3_read, mvpp2_bm_pool_update_fc, mvpp2_bm_pool_update_priv_fc, mvpp2_bm_switch_buffers, and mvpp2_change_mtu.
• Logs: System crash/reboot events logged in /var/log/syslog, /var/log/kern.log, or equivalent, coinciding with network interface MTU change operations.
• Process/Network: Unexpected or repeated MTU change commands (ip link set ... mtu) issued on Marvell PP2 network interfaces, particularly crossing the jumbo frame threshold, from non-administrative user accounts.

Apply the kernel patches available across stable branches: upgrade to Linux kernel 5.15.203+, 6.1.167+, 6.6.130+, 6.12.78+, 6.18.20+, or 6.19.10+. The fix adds a priv->global_tx_fc guard to both the disable and re-enable calls in mvpp2_bm_switch_buffers(), consistent with all other flow control call sites in the driver. As a workaround where patching is not immediately possible, ensure the CM3 SRAM memory resource is properly declared in the device tree for supported Marvell CP110/CP115 hardware, or restrict local user access to prevent MTU changes on affected interfaces (Github Advisory, Kernel Patch).