Cloudanix VulnDB

CVE-2026-23019

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Jan 31, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in certain network hardware drivers can crash the whole computer if the system runs out of memory during startup, and updating the operating system fixes it.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Unconditional devlink_priv() call on potentially NULL return from devlink_alloc() in prestera_devlink_alloc() triggers kernel NULL pointer dereference and crash.

Why it matters to the business

Systems using the Marvell Prestera network driver may experience unexpected kernel panics and service interruption when memory allocation fails during device initialization, increasing operational downtime risk on affected Linux deployments.

How an attack unfolds

An attacker with local access can trigger memory pressure to cause devlink_alloc() to fail; the missing NULL check then dereferences the pointer inside prestera_devlink_alloc(), crashing the kernel. No remote or unauthenticated exploitation path exists.

How to fix it

Upgrade the Linux kernel to a version containing commit 8a4333b2818f0d853b43e139936c20659366e4a0 or later; rebuild and reboot with the patched kernel. For distributions, apply the vendor backport when available.

How to confirm the fix worked

Confirm the running kernel contains the fix commit 8a4333b2818f0d853b43e139936c20659366e4a0 in net/marvell/prestera or verify that prestera_devlink_alloc() now explicitly checks the devlink_alloc() return value before calling devlink_priv().

Typical attack path

  1. Obtain local user access on a Linux system loading the prestera driver
  2. Exhaust kernel memory to force devlink_alloc() failure during device probe or reload
  3. Trigger prestera_devlink_alloc() path that omits the NULL check
  4. Cause NULL dereference leading to kernel oops or panic

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for oops or panic messages containing prestera_devlink_alloc, devlink_alloc, or devlink_priv around device initialization; correlate with memory-pressure events.

  • prestera_devlink_alloc
  • devlink_alloc
  • devlink_priv
  • NULL dereference in prestera

What your security team should do

  • Prioritize kernel upgrade on any system exposing the prestera driver
  • Monitor for kernel oops reports referencing prestera_devlink_alloc or devlink_priv
  • Apply the patch within standard maintenance windows given the local-only attack surface

The record

In the Linux kernel, the following vulnerability has been resolved: net: marvell: prestera: fix NULL dereference on devlink_alloc() failure devlink_alloc() may return NULL on allocation failure, but prestera_devlink_alloc() unconditionally calls devlink_priv() on the returned pointer. This leads to a NULL pointer dereference if devlink allocation fails. Add a check for a NULL devlink pointer and return NULL early to avoid the crash.

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 5.10.0 5.15.198

Related vulnerabilities