CVE-2026-68345: Linux Kernel Privilege Escalation Flaw

CVE-2026-68345 Overview

CVE-2026-68345 is a NULL pointer dereference vulnerability in the Linux kernel's arm_mpam driver. The flaw resides in the __destroy_component_cfg() function, which adds each Resource Instance Selector (RIS) mbwu_state object to the MPAM garbage list when destroying component configuration. Because mbwu_state is allocated per RIS and only for RISes with Memory Bandwidth Usage (MBWU) monitors, a component can have comp->cfg allocated while some RISes still have ris->mbwu_state set to NULL. Passing a NULLmbwu_state to add_to_garbage() dereferences the pointer inside the macro. The upstream fix skips RISes without an mbwu_state object before adding them to the garbage list.

Critical Impact
A NULL pointer dereference in the ARM MPAM component configuration destroy path can trigger a kernel oops, leading to a denial-of-service condition on affected Linux systems.

Affected Products

Linux kernel builds including the arm_mpam driver prior to the fix commits
Systems running on ARM platforms with Memory Partitioning and Monitoring (MPAM) support
Downstream distributions shipping the vulnerable arm_mpam code paths

Discovery Timeline

2026-08-10 - CVE-2026-68345 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68345

Vulnerability Analysis

The vulnerability lives in the ARM MPAM (Memory Partitioning and Monitoring) subsystem of the Linux kernel. During teardown, __destroy_component_cfg() iterates over each RIS attached to a component and hands the associated mbwu_state object to the add_to_garbage() macro for deferred cleanup. The teardown logic assumes every RIS reachable from comp->cfg also owns a valid mbwu_state allocation.

That assumption does not hold in practice. The mbwu_state structure is allocated per RIS, and only for RISes that expose MBWU monitors. A component may therefore have comp->cfg populated while one or more RISes still hold a NULLmbwu_state. When the teardown path reaches such a RIS, add_to_garbage() dereferences the NULL pointer inside the macro expansion, triggering a kernel NULL pointer dereference [CWE-476].

Root Cause

The root cause is a missing guard in the component destruction path. The code treats mbwu_state allocation as universal across RISes, but the allocator only creates the structure when the RIS advertises an MBWU monitor. The patch resolves the mismatch by skipping RISes that do not have an mbwu_state object before adding them to the garbage list.

Attack Vector

This issue is reached through kernel-internal MPAM configuration teardown on ARM systems with mixed RIS capabilities. Exploitation requires code paths that create and destroy MPAM component configurations on hardware where at least one RIS lacks an MBWU monitor. The realistic impact is a kernel crash and denial of service rather than code execution. Remote exploitation is not indicated in the advisory data.

No public proof-of-concept code is available for CVE-2026-68345. Refer to the upstream commits 977f52909c and ca1f96334 for the exact source-level change.

Detection Methods for CVE-2026-68345

Indicators of Compromise

Kernel oops or panic messages referencing __destroy_component_cfg, add_to_garbage, or the arm_mpam module in dmesg and /var/log/kern.log.
Unexpected reboots or hangs on ARM hosts during MPAM component teardown or resctrl filesystem operations.

Detection Strategies

Audit running kernel versions against the fixed commits 977f52909c and ca1f96334 to identify unpatched ARM systems.
Correlate crash dumps from ARM MPAM-capable hosts with call traces containing add_to_garbage to distinguish this defect from unrelated NULL dereferences.

Monitoring Recommendations

Ship kernel ring buffer logs to a central log store and alert on BUG: kernel NULL pointer dereference events tagged with arm_mpam symbols.
Track ARM host uptime and unplanned reboot metrics to surface repeated crashes during MPAM configuration changes.
Baseline crash frequency across fleets so a spike in ARM kernel oops events triggers investigation.

How to Mitigate CVE-2026-68345

Immediate Actions Required

Apply the upstream fix by updating to a Linux kernel release that includes commits 977f52909c624210178a1247fab0b02b110c1106 and ca1f96334267ab8d47b2c9d535cdc9920fdde269.
Track your distribution vendor's advisories and roll out the corresponding kernel package on ARM systems with MPAM support.
Prioritize patching hosts where MPAM component configuration is actively created and destroyed at runtime.

Patch Information

The upstream fix guards each RIS by checking for a valid mbwu_state object before calling add_to_garbage(). RISes without an mbwu_state allocation are skipped. The change is available in the stable kernel commits 977f52909c and ca1f96334.

Workarounds

Where feasible, avoid dynamic teardown of MPAM component configurations on ARM systems that mix RISes with and without MBWU monitors until the patched kernel is deployed.
If MPAM is not required for the workload, disable the arm_mpam driver in the kernel configuration or via boot parameters to eliminate exposure to the vulnerable code path.

bash

# Confirm running kernel and check for arm_mpam module presence
uname -r
lsmod | grep arm_mpam

# Review kernel logs for signatures of the NULL dereference
dmesg | grep -iE 'arm_mpam|add_to_garbage|__destroy_component_cfg'