CVE-2026-23107

A flaw was found in the Linux kernel on arm64 architectures. When restoring a ZA signal context, the kernel may fail to allocate the necessary memory (sve_state), leading to a NULL pointer dereference. A local, unprivileged user can exploit this vulnerability, potentially causing the kernel to crash and resulting in a Denial of Service (DoS).

A local NULL pointer dereference can occur on arm64 when restoring a ZA signal context because restore_za_context can set TIF_SME without ensuring current thread sve_state is allocated. In uncommon but legitimate scenarios such as process save and restore workflows using CRIU the signal context may not have been created by the same kernel task and there is no guarantee that sve_state exists. In that state userspace can enter streaming mode while sve_state is NULL and a later kernel attempt to save register state can dereference NULL in sve_save_state and crash the kernel. For the CVSS the PR is N because an unprivileged local process can reach signal return paths without special rights. The issue is not network reachable. Impact is denial of service via kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.