CVE-2026-68345: arm_mpam: guard MBWU state before adding it to garbage
In the Linux kernel, the following vulnerability has been resolved:
armmpam: guard MBWU state before adding it to garbage
destroycomponentcfg() adds each RIS mbwustate object to the MPAM garbage list when destroying component configuration.
However, mbwustate is allocated per RIS and only for RISes with MBWU monitors. A component can therefore have comp->cfg allocated while some RISes still have ris->mbwustate set to NULL.
Passing a NULL mbwustate to addtogarbage() dereferences the NULL pointer inside the macro.
Skip RISes that do not have an mbwustate object before adding them to the garbage list.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68345?
The severity of CVE-2026-68345 is rated as risk 34.
How do I fix CVE-2026-68345?
To fix CVE-2026-68345, update your Linux kernel to the latest version that has resolved this vulnerability.
What is CVE-2026-68345?
CVE-2026-68345 is a vulnerability in the Linux kernel related to guarding the MBWU state in the arm_mpam subsystem.
What systems are affected by CVE-2026-68345?
CVE-2026-68345 affects Linux kernel versions that implement the arm_mpam subsystem.
When was CVE-2026-68345 published?
CVE-2026-68345 was published on August 10, 2026.