CVE-2026-23433: arm_mpam: Fix null pointer dereference when restoring bandwidth counters

Q: Which systems are exposed to this failure?

The issue applies when an MSC that supports memory bandwidth monitoring is taken offline and later brought back online. The affected code path restores bandwidth-counter configuration during that online transition.

Q: What conditions are needed to trigger it?

An attacker needs local access with low privileges according to the CVSS vector. Triggering also depends on causing the offline/online sequence for an MSC with memory bandwidth monitoring support.

Q: How can I tell whether the issue has occurred?

The failure results in a kernel oops caused by a null pointer dereference in __ris_msmon_read() while mpam_restore_mbwu_state() restores bandwidth-counter state. A call trace containing __ris_msmon_read, mpam_restore_mbwu_state, and smp_call_on_cpu_callback is indicative.

Published Apr 3, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

armmpam: Fix null pointer dereference when restoring bandwidth counters

When an MSC supporting memory bandwidth monitoring is brought offline and then online, mpamrestorembwustate() calls rismsmonread() via ipi to restore the configuration of the bandwidth counters. It doesn't care about the value read, mbwuarg.val, and doesn't set it leading to a null pointer dereference when rismsmonread() adds to it. This results in a kernel oops with a call trace such as:

Call trace: rismsmonread+0x19c/0x64c (P) mpamrestorembwustate+0xa0/0xe8 smpcalloncpucallback+0x1c/0x38 processonework+0x154/0x4b4 workerthread+0x188/0x310 kthread+0x11c/0x130 retfromfork+0x10/0x20

Provide a local variable for val to avoid rismsmonread() dereferencing a null pointer when adding to val.

Affected Software

10 affected components

Linux Linux kernel

Linux Linux kernel>=6.19.1<6.19.10

Linux Linux kernel=6.19

Linux Linux kernel=7.0-rc1

Linux Linux kernel=7.0-rc2

Linux Linux kernel=7.0-rc3

Linux Linux kernel=7.0-rc4

Linux Linux kernel=7.0-rc5

Linux Linux kernel=7.0-rc6

Linux Linux kernel=7.0-rc7

Event History

Apr 3, 2026

CVE Published

via MITRE·03:15 PM

Data Sourced

via MITRE·03:15 PM

Description

Data Sourced

via NVD·04:16 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which systems are exposed to this failure?

The issue applies when an MSC that supports memory bandwidth monitoring is taken offline and later brought back online. The affected code path restores bandwidth-counter configuration during that online transition.

What conditions are needed to trigger it?

An attacker needs local access with low privileges according to the CVSS vector. Triggering also depends on causing the offline/online sequence for an MSC with memory bandwidth monitoring support.

How can I tell whether the issue has occurred?

The failure results in a kernel oops caused by a null pointer dereference in __ris_msmon_read() while mpam_restore_mbwu_state() restores bandwidth-counter state. A call trace containing __ris_msmon_read, mpam_restore_mbwu_state, and smp_call_on_cpu_callback is indicative.

CVE-2026-23433: arm_mpam: Fix null pointer dereference when restoring bandwidth counters

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this failure?

What conditions are needed to trigger it?

How can I tell whether the issue has occurred?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this failure?

What conditions are needed to trigger it?

How can I tell whether the issue has occurred?