CVE-2026-23433 is a Linux kernel bug in the ARM MPAM (Memory Partitioning and Monitoring) “mpam” driver that can trigger a kernel crash (null pointer dereference) when an MSC (Memory System Controller) that supports memory bandwidth monitoring is taken offline and then brought back online. The issue is in drivers/resctrl/mpam_devices.c, specifically in the bandwidth counter restore path involving mpam_restore_mbwu_state() and __ris_msmon_read().
Technically, when the MSC is brought offline and then online, mpam_restore_mbwu_state() uses an IPI-based call to invoke __ris_msmon_read() to restore bandwidth counter configuration. The restore logic “doesn't care about the value read” and, per the advisory text, does not set mbwu_arg.val. As a result, __ris_msmon_read() later performs arithmetic that adds to val, but val is effectively null/uninitialized in this call context, leading to a null pointer dereference and a kernel oops. The provided call trace shows the crash occurring in __ris_msmon_read, then returning to mpam_restore_mbwu_state, and continuing through the normal SMP callback/workqueue execution path (smp_call_on_cpu_callback, process_one_work, worker_thread, kthread).
Impact-wise, this is a local denial-of-service condition: an attacker (or an automated system) that can trigger the offline/online transition for the relevant MPAM MSC can cause a kernel oops/crash. The NVD entry does not provide a CVSS score or severity rating (“Severity: unknown | CVSS: N/A”), so the exact exploitability and risk level beyond “kernel oops” cannot be quantified from the provided data. The blast radius is limited to systems running affected Linux kernel versions with ARM MPAM bandwidth monitoring enabled/used, and specifically to the code path that restores bandwidth counters after MSC state transitions.
Mitigation: apply the upstream fix commit 4ad79c874e53ebb7fe3b8ae7ac6c858a2121f415 (also referenced by the stable backport ac3e12bc195786d3d44d730b5b2259fd36191848). The patch adds a local u64 val; variable in mpam_restore_mbwu_state() so that __ris_msmon_read() has a valid destination/value to add to, preventing the null pointer dereference. No workaround is described in the provided references; the actionable guidance from the patch text is to upgrade to a kernel version that includes the fix (the stable backport indicates it is intended for stable trees). Detection guidance is not provided in the supplied material; however, the call trace signature would include __ris_msmon_read followed by mpam_restore_mbwu_state during MSC offline/online operations.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476