CVE-2026-68328

What it actually does

Unchecked return value from nfp_cpp_mutex_alloc() results in a null pointer being passed to nfp_cpp_mutex_trylock(), causing a kernel null pointer dereference during resource acquisition in the NFP driver.

Why it matters to the business

Systems relying on affected network hardware risk unexpected kernel crashes or service interruptions when resource allocation fails under memory pressure, potentially affecting network connectivity and requiring reboots.

How an attack unfolds

An attacker induces memory pressure on a target system and then triggers network operations that invoke the vulnerable resource lookup path in the NFP driver, causing the allocation to fail and the subsequent dereference to panic the kernel.

How to fix it

Update the Linux kernel to a version containing the fix that returns -ENOMEM when nfp_cpp_mutex_alloc fails, matching the behavior already present in nfp_resource_acquire.

How to confirm the fix worked

Inspect the nfp driver source for the added allocation check before publishing the resource handle, and reproduce the failure path under controlled memory exhaustion to confirm the lookup now fails gracefully.

Typical attack path

1. Apply memory pressure to force allocation failures
2. Initiate traffic or operations that exercise nfp_cpp_resource_find
3. Trigger the unchecked NULL handle path leading to dereference
4. Cause kernel panic or denial of service

How to detect it

Search kernel logs and dmesg for null pointer dereference reports originating from nfp driver functions during resource acquisition; correlate with periods of high memory usage or network activity.

What your security team should do

• Prioritize kernel updates for systems using NFP-based network cards
• Monitor kernel logs for oops or null dereference traces involving nfp_cpp_mutex
• Test resource acquisition paths under simulated low-memory conditions after patching