CVE-2026-23019: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23019 Overview

CVE-2026-23019 is a Null Pointer Dereference vulnerability affecting the Linux kernel's Marvell Prestera network driver. The vulnerability exists in the prestera_devlink_alloc() function, which unconditionally calls devlink_priv() on the pointer returned by devlink_alloc() without first checking if the allocation succeeded. When devlink_alloc() fails and returns NULL due to memory allocation failure, the subsequent call to devlink_priv() dereferences this NULL pointer, leading to a kernel crash.

Critical Impact

A NULL pointer dereference in the Linux kernel Marvell Prestera driver can cause system crashes and denial of service conditions when memory allocation fails during network device initialization.

Affected Products

• Linux Kernel with Marvell Prestera network driver enabled
• Systems using Marvell Prestera network switching hardware
• Network infrastructure devices running affected kernel versions

Discovery Timeline

• 2026-01-31 - CVE CVE-2026-23019 published to NVD
• 2026-02-03 - Last updated in NVD database

Technical Details for CVE-2026-23019

Vulnerability Analysis

This vulnerability is a classic example of missing NULL pointer validation in kernel code. The devlink_alloc() function is responsible for allocating memory for a devlink structure, which is a framework used for exposing device hardware information and configuration to userspace. When system memory is constrained or allocation fails for any reason, this function returns NULL to indicate the failure.

The vulnerable code path in the Marvell Prestera driver fails to account for this failure case. The prestera_devlink_alloc() function immediately passes the potentially NULL pointer to devlink_priv(), which attempts to calculate and return an offset within the devlink structure. When operating on a NULL pointer, this results in accessing invalid memory addresses, triggering a kernel panic.

The impact of this vulnerability is primarily denial of service through kernel crashes. While remote exploitation is unlikely without other enabling conditions, local attackers or system conditions that trigger memory pressure during driver initialization could exploit this flaw to crash the system.

Root Cause

The root cause is improper error handling in the prestera_devlink_alloc() function. The code assumes that devlink_alloc() always succeeds and does not implement defensive programming practices to validate the returned pointer before use. This missing NULL check allows the code path to continue with an invalid pointer, resulting in undefined behavior when the pointer is dereferenced.

Attack Vector

The vulnerability can be triggered when the kernel fails to allocate memory during Marvell Prestera network device initialization. While the attack vector details are not fully specified in the CVE data, the vulnerability manifests during the device driver initialization phase.

An attacker with local access could potentially trigger memory pressure conditions that cause devlink_alloc() to fail, or the condition could occur naturally on systems with limited memory resources. The resulting kernel crash causes a denial of service, requiring a system reboot to recover.

The fix adds a simple NULL pointer check after devlink_alloc() returns, ensuring that the function returns NULL early if allocation fails rather than proceeding with an invalid pointer.

Detection Methods for CVE-2026-23019

Indicators of Compromise

• Unexpected kernel panics or system crashes during network device initialization
• Kernel oops messages referencing the prestera_devlink_alloc or devlink_priv functions
• System log entries showing NULL pointer dereference errors in the Marvell Prestera driver
• Repeated system reboots when Marvell Prestera network hardware is present

Detection Strategies

• Monitor kernel logs (dmesg, /var/log/kern.log) for NULL pointer dereference errors related to the prestera or devlink subsystems
• Implement kernel crash dump analysis to identify crashes originating from the Marvell Prestera driver code path
• Use kernel debugging tools such as KASAN (Kernel Address Sanitizer) to detect NULL pointer access during testing
• Deploy system monitoring to alert on unexpected kernel panics during network device initialization

Monitoring Recommendations

• Configure centralized logging to capture kernel panic events and crash dumps from systems with Marvell Prestera hardware
• Set up alerts for system reboots that occur during boot or driver loading phases
• Monitor system memory utilization to identify conditions that may lead to allocation failures
• Implement health checks for network devices using Marvell Prestera switching hardware

How to Mitigate CVE-2026-23019

Immediate Actions Required

• Review systems with Marvell Prestera network hardware and identify those running vulnerable kernel versions
• Apply available kernel patches from the official Linux kernel stable branches
• Ensure adequate system memory is available to reduce the likelihood of allocation failures
• Monitor affected systems for unexpected crashes until patches can be applied

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability. The fix adds a NULL pointer check after the devlink_alloc() call and returns NULL early if the allocation fails, preventing the NULL pointer dereference.

Multiple commits have been applied to various stable kernel branches:

• Kernel Git Commit 325aea7
• Kernel Git Commit 326a4b7
• Kernel Git Commit 3950054
• Kernel Git Commit 8a4333b
• Kernel Git Commit 94e070c
• Kernel Git Commit a428e0d

Organizations should update to kernel versions containing these fixes through their standard kernel update processes.

Workarounds

• If the Marvell Prestera driver is not required, disable or blacklist the prestera kernel module to prevent it from loading
• Ensure systems have adequate memory resources to minimize the risk of allocation failures
• Implement kernel module loading restrictions to prevent the vulnerable driver from loading until patched
• Consider using alternative network hardware if patches cannot be immediately applied

# Blacklist the prestera module to prevent loading (temporary workaround)
echo "blacklist prestera" | sudo tee /etc/modprobe.d/blacklist-prestera.conf
sudo update-initramfs -u