CVE-2026-23438
published 2026-04-03CVE-2026-23438: In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: guard flow control update with global_tx_fc in buffer switching…
PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.13%
2.6th percentile
In the Linux kernel, the following vulnerability has been resolved:
net: mvpp2: guard flow control update with global_tx_fc in buffer switching
mvpp2_bm_switch_buffers() unconditionally calls
mvpp2_bm_pool_update_priv_fc() when switching between per-cpu and
shared buffer pool modes. This function programs CM3 flow control
registers via mvpp2_cm3_read()/mvpp2_cm3_write(), which dereference
priv->cm3_base without any NULL check.
When the CM3 SRAM resource is not present in the device tree (the
third reg entry added by commit 60523583b07c ("dts: marvell: add CM3
SRAM memory to cp11x ethernet device tree")), priv->cm3_base remains
NULL and priv->global_tx_fc is false. Any operation that triggers
mvpp2_bm_switch_buffers(), for example an MTU change that crosses
the jumbo frame threshold, will crash:
Unable to handle kernel NULL pointer dereference at
virtual address 0000000000000000
Mem abort info:
ESR = 0x0000000096000006
EC = 0x25: DABT (current EL), IL = 32 bits
pc : readl+0x0/0x18
lr : mvpp2_cm3_read.isra.0+0x14/0x20
Call trace:
readl+0x0/0x18
mvpp2_bm_pool_update_fc+0x40/0x12c
mvpp2_bm_pool_update_priv_fc+0x94/0xd8
mvpp2_bm_switch_buffers.isra.0+0x80/0x1c0
mvpp2_change_mtu+0x140/0x380
__dev_set_mtu+0x1c/0x38
dev_set_mtu_ext+0x78/0x118
dev_set_mtu+0x48/0xa8
dev_ifsioc+0x21c/0x43c
dev_ioctl+0x2d8/0x42c
sock_ioctl+0x314/0x378
Every other flow control call site in the driver already guards
hardware access with either priv->global_tx_fc or port->tx_fc.
mvpp2_bm_switch_buffers() is the only place that omits this check.
Add the missing priv->global_tx_fc guard to both the disable and
re-enable calls in mvpp2_bm_switch_buffers(), consistent with the
rest of the driver.
Affected
31 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.19.10-1 (forky) | linux 6.19.10-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= 3a616b92a9d17448d96a33bf58e69f01457fd43a < 0cfcd31f98fc608dc9406bff3fee3a9dd364d014 | 0cfcd31f98fc608dc9406bff3fee3a9dd364d014 |
| linux | linux | >= 3a616b92a9d17448d96a33bf58e69f01457fd43a < da089f74a993f846685067b14158cb41b879ff29 | da089f74a993f846685067b14158cb41b879ff29 |
| linux | linux | >= 3a616b92a9d17448d96a33bf58e69f01457fd43a < ff0c54f088f7ab91dbbf47cf8244460f99122750 | ff0c54f088f7ab91dbbf47cf8244460f99122750 |
| linux | linux | >= 3a616b92a9d17448d96a33bf58e69f01457fd43a < 7bd20f4b3ef3044dc55acd5b8ef748a70d29d03f | 7bd20f4b3ef3044dc55acd5b8ef748a70d29d03f |
| linux | linux | >= 3a616b92a9d17448d96a33bf58e69f01457fd43a < 7df2b50cae1a76cbb90b294f3edb61e3e10bf2e9 | 7df2b50cae1a76cbb90b294f3edb61e3e10bf2e9 |
| linux | linux | >= 3a616b92a9d17448d96a33bf58e69f01457fd43a < 8baced53a35fc9710f80d6ca016a2c418dc3231f | 8baced53a35fc9710f80d6ca016a2c418dc3231f |
| linux | linux | >= 3a616b92a9d17448d96a33bf58e69f01457fd43a < 8a63baadf08453f66eb582fdb6dd234f72024723 | 8a63baadf08453f66eb582fdb6dd234f72024723 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.19.10-1 | 6.19.10-1 |
| linux | linux_kernel | >= 5.12.1 < 5.15.203 | 5.15.203 |
| linux | linux_kernel | >= 5.16 < 6.1.167 | 6.1.167 |
| linux | linux_kernel | >= 6.13 < 6.18.20 | 6.18.20 |
| linux | linux_kernel | >= 6.19 < 6.19.10 | 6.19.10 |
| linux | linux_kernel | >= 6.2 < 6.6.130 | 6.6.130 |
| linux | linux_kernel | >= 6.7 < 6.12.78 | 6.12.78 |
| ubuntu | linux | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_ubuntu2.0LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 7.0-rc4 mvpp2 mvpp2_bm_switch_buffers null pointer dereference (EUVD-2026-18679 / Nessus ID 304988)
vuldb·2026-07-17·CVSS 5.5
CVE-2026-23438 [MEDIUM] Linux Kernel up to 7.0-rc4 mvpp2 mvpp2_bm_switch_buffers null pointer dereference (EUVD-2026-18679 / Nessus ID 304988)
A vulnerability was found in Linux Kernel up to 7.0-rc4. It has been rated as critical. This issue affects the function mvpp2_bm_switch_buffers of the component mvpp2. This manipulation causes null pointer dereference.
This vulnerability is tracked as CVE-2026-23438. The attack is only possible within the local network. No exploit exists.
Upgrading the affected component is advised.
OSV
CVE-2026-23438: In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: guard flow control update with global_tx_fc in buffer switching mvpp2_
osv·2026-04-03
CVE-2026-23438 CVE-2026-23438: In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: guard flow control update with global_tx_fc in buffer switching mvpp2_
In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: guard flow control update with global_tx_fc in buffer switching mvpp2_bm_switch_buffers() unconditionally calls mvpp2_bm_pool_update_priv_fc() when switching between per-cpu and shared buffer pool modes. This function programs CM3 flow control registers via mvpp2_cm3_read()/mvpp2_cm3_write(), which dereference priv->cm3_base without any NULL check. When the CM3 SRAM resource is not present in the device tree (the third reg entry added by commit 60523583b07c ("dts: marvell: add CM3 SRAM memory to cp11x ethernet device tree")), priv->cm3_base remains NULL and priv->global_tx_fc is false. Any operation that triggers mvpp2_bm_switch_buffers(), for example an MTU change that crosses the jumbo frame threshold, will c
GHSA
GHSA-4m78-cvj8-m5m2: In the Linux kernel, the following vulnerability has been resolved:
net: mvpp2: guard flow control update with global_tx_fc in buffer switching
mvpp
ghsa_unreviewed·2026-04-03
CVE-2026-23438 GHSA-4m78-cvj8-m5m2: In the Linux kernel, the following vulnerability has been resolved:
net: mvpp2: guard flow control update with global_tx_fc in buffer switching
mvpp
In the Linux kernel, the following vulnerability has been resolved:
net: mvpp2: guard flow control update with global_tx_fc in buffer switching
mvpp2_bm_switch_buffers() unconditionally calls
mvpp2_bm_pool_update_priv_fc() when switching between per-cpu and
shared buffer pool modes. This function programs CM3 flow control
registers via mvpp2_cm3_read()/mvpp2_cm3_write(), which dereference
priv->cm3_base without any NULL check.
When the CM3 SRAM resource is not present in the device tree (the
third reg entry added by commit 60523583b07c ("dts: marvell: add CM3
SRAM memory to cp11x ethernet device tree")), priv->cm3_base remains
NULL and priv->global_tx_fc is false. Any operation that triggers
mvpp2_bm_switch_buffers(), for example an MTU change that crosses
the jumbo frame threshold, wil
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-20·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local attacke
Red Hat
kernel: net: mvpp2: guard flow control update with global_tx_fc in buffer switching
vendor_redhat·2026-04-03
CVE-2026-23438 CWE-476 kernel: net: mvpp2: guard flow control update with global_tx_fc in buffer switching
kernel: net: mvpp2: guard flow control update with global_tx_fc in buffer switching
In the Linux kernel, the following vulnerability has been resolved:
net: mvpp2: guard flow control update with global_tx_fc in buffer switching
mvpp2_bm_switch_buffers() unconditionally calls
mvpp2_bm_pool_update_priv_fc() when switching between per-cpu and
shared buffer pool modes. This function programs CM3 flow control
registers via mvpp2_cm3_read()/mvpp2_cm3_write(), which dereference
priv->cm3_base without any NULL check.
When the CM3 SRAM resource is not present in the device tree (the
third reg entry added by commit 60523583b07c ("dts: marvell: add CM3
SRAM memory to cp11x ethernet device tree")), priv->cm3_base remains
NULL and priv->global_tx_fc is false. Any operation that triggers
mvpp2_bm_switc
Debian
CVE-2026-23438: linux - In the Linux kernel, the following vulnerability has been resolved: net: mvpp2:...
vendor_debian·2026
CVE-2026-23438 CVE-2026-23438: linux - In the Linux kernel, the following vulnerability has been resolved: net: mvpp2:...
In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: guard flow control update with global_tx_fc in buffer switching mvpp2_bm_switch_buffers() unconditionally calls mvpp2_bm_pool_update_priv_fc() when switching between per-cpu and shared buffer pool modes. This function programs CM3 flow control registers via mvpp2_cm3_read()/mvpp2_cm3_write(), which dereference priv->cm3_base without any NULL check. When the CM3 SRAM resource is not present in the device tree (the third reg entry added by commit 60523583b07c ("dts: marvell: add CM3 SRAM memory to cp11x ethernet device tree")), priv->cm3_base remains NULL and priv->global_tx_fc is false. Any operation that triggers mvpp2_bm_switch_buffers(), for example an MTU change that crosses the jumbo frame threshold, will c
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/0cfcd31f98fc608dc9406bff3fee3a9dd364d014https://git.kernel.org/stable/c/7bd20f4b3ef3044dc55acd5b8ef748a70d29d03fhttps://git.kernel.org/stable/c/7df2b50cae1a76cbb90b294f3edb61e3e10bf2e9https://git.kernel.org/stable/c/8a63baadf08453f66eb582fdb6dd234f72024723https://git.kernel.org/stable/c/8baced53a35fc9710f80d6ca016a2c418dc3231fhttps://git.kernel.org/stable/c/da089f74a993f846685067b14158cb41b879ff29https://git.kernel.org/stable/c/ff0c54f088f7ab91dbbf47cf8244460f99122750https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlhttps://cert-portal.siemens.com/productcert/html/ssa-082556.html
2026-04-03
Published