CVE-2026-64165 Overview
CVE-2026-64165 is a Linux kernel vulnerability affecting the ARM Integrator/CP platform code. The flaw resides in intcp_init_early, which calls syscon_regmap_lookup_by_compatible before the memory management subsystem is initialized. The downstream call to of_syscon_register attempts to allocate memory via __kmalloc_cache_noprof, which fails or triggers a NULL pointer dereference during early boot. The issue was introduced by commit bdb249fce9ad4 ("ARM: integrator: read counter using syscon/regmap") and manifests as a kernel Oops on affected ARM Integrator hardware. The fix moves the early initialization code into the standard machine initialization path.
Critical Impact
Boot-time NULL pointer dereference on ARM Integrator/CP systems, causing kernel panic and denial of service before user space starts.
Affected Products
- Linux kernel builds targeting the ARM Integrator/CP platform
- Kernel versions containing commit bdb249fce9ad4 prior to the fix
- ARM defconfig builds compiled with gcc 10.x, 11.x, and 13.x
Discovery Timeline
- 2026-07-19 - CVE-2026-64165 published to NVD
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-64165
Vulnerability Analysis
The vulnerability is a NULL pointer dereference [CWE-476] triggered during early kernel boot on ARM Integrator/CP hardware. The intcp_init_early function executes from start_kernel before memory management has been brought online. It calls syscon_regmap_lookup_by_compatible, which internally calls of_syscon_register to allocate a regmap structure. Because the slab allocator is not yet available, __kmalloc_cache_noprof operates on uninitialized allocator state and dereferences a NULL pointer at virtual address 0000000c.
Behavior varies by compiler version. Builds produced with gcc 9.x avoid the dereference and instead surface -ENOMEM from the allocation attempt, causing sched_clock_register to be skipped silently. Builds produced with gcc 10.x, 11.x, and 13.x reliably reproduce the Oops shown in the call trace from __kmalloc_cache_noprof through of_syscon_register to intcp_init_early.
Root Cause
The root cause is an ordering violation between platform-specific early init and core kernel subsystem initialization. intcp_init_early was extended to consume the syscon/regmap subsystem, which itself depends on the slab allocator. Placing this work in the init_early machine hook runs it before mm_init, so memory allocation cannot succeed.
Attack Vector
The issue is a reliability defect exposed at boot. It is not remotely exploitable and requires no attacker interaction. The impact is limited to denial of service on ARM Integrator/CP targets running an affected kernel build. The vulnerability manifests before any network or user-space attack surface is available.
Detection Methods for CVE-2026-64165
Indicators of Compromise
- Kernel Oops message Unable to handle kernel NULL pointer dereference at virtual address 0000000c during boot on ARM Integrator/CP hardware.
- Call trace containing __kmalloc_cache_noprof → of_syscon_register → device_node_get_regmap → intcp_init_early → start_kernel.
- Silent boot failure where sched_clock_register is never invoked, resulting in absent scheduler clock functionality.
Detection Strategies
- Audit the running kernel version against the fixed commits: 22c738fb51f2, 33ad014abec9, 508b1193d63b, 58a112b0973f, 6624854554c4, 812103fb6da9, 90d77b30a666, and e984dc22e2c2.
- Inspect ARM defconfig builds targeting Integrator platforms for the presence of commit bdb249fce9ad4 without the corresponding fix.
- Collect serial console logs from affected boards and grep for the fault signature emitted from intcp_init_early.
Monitoring Recommendations
- Track upstream linux-stable releases for backports referenced in the technical references section.
- Monitor build-farm boot tests for ARM Integrator/CP configurations across multiple gcc toolchain versions.
- Alert on unexpected -ENOMEM returns from syscon_regmap_lookup_by_compatible during early boot in kernel logs.
How to Mitigate CVE-2026-64165
Immediate Actions Required
- Apply the upstream fix that relocates the syscon/regmap lookup from intcp_init_early into the standard machine initialization path.
- Rebuild affected ARM Integrator/CP kernel images from a stable branch containing one of the fixed commits.
- If a rebuild is not immediately possible, boot from a pre-bdb249fce9ad4 kernel until the patched image is deployed.
Patch Information
The fix has been merged across multiple stable branches. Reference the upstream commits: Kernel Git Commit 22c738f, Kernel Git Commit 33ad014, Kernel Git Commit 508b119, Kernel Git Commit 58a112b, Kernel Git Commit 6624854, Kernel Git Commit 812103f, Kernel Git Commit 90d77b3, and Kernel Git Commit e984dc2.
Workarounds
- Compile affected kernels with gcc 9.x to avoid the NULL pointer dereference, accepting that sched_clock_register will not run.
- Disable the ARM Integrator/CP machine support in the kernel configuration if the platform is not required in the deployment.
- Revert commit bdb249fce9ad4 locally until the upstream fix is integrated into the vendor kernel tree.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
