CVE-2026-23438

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: mvpp2: guard flow control update with global_tx_fc in buffer switching

mvpp2_bm_switch_buffers() unconditionally calls

mvpp2_bm_pool_update_priv_fc() when switching between per-cpu and

shared buffer pool modes. This function programs CM3 flow control

registers via mvpp2_cm3_read()/mvpp2_cm3_write(), which dereference

priv->cm3_base without any NULL check.

When the CM3 SRAM resource is not present in the device tree (the

third reg entry added by commit 60523583b07c ("dts: marvell: add CM3

SRAM memory to cp11x ethernet device tree")), priv->cm3_base remains

NULL and priv->global_tx_fc is false. Any operation that triggers

mvpp2_bm_switch_buffers(), for example an MTU change that crosses

the jumbo frame threshold, will crash:

Unable to handle kernel NULL pointer dereference at

virtual address 0000000000000000

Mem abort info:

ESR = 0x0000000096000006

EC = 0x25: DABT (current EL), IL = 32 bits

pc :

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References