Skip to main content

Linux Kernel CVE-2026-53028

| EUVDEUVD-2026-38896 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-06-24 Linux GHSA-fw2f-r9xj-6gr9
Denial Of Service Linux Null Pointer Dereference Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local attack, low privileges to trigger USB Type-C events; impact is kernel crash only, no confidentiality or integrity exposure.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.6 MEDIUM
AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 15, 2026 - 17:01 vuln.today
CVSS changed
Jul 15, 2026 - 14:52 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:29 nvd
MEDIUM 5.5
CVE Published
Jun 24, 2026 - 16:29 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: Fix error pointer dereference

The variable tps->partner is checked for an error pointer and then if it is, it sends an error message but does not return and then immediately dereferenced a few lines below:

tps->partner = typec_register_partner(tps->port, &desc); if (IS_ERR(tps->partner)) dev_warn(tps->dev, "%s: failed to register partnet\n", __func__);

if (desc.identity) { typec_partner_set_identity(tps->partner); cd321x->cur_partner_identity = st.partner_identity; }

Add early return and fix spelling mistake in error message.

Detected by Smatch: drivers/usb/typec/tipd/core.c:827 cd321x_update_work() error: 'tps->partner' dereferencing possible ERR_PTR()

AnalysisAI

Error pointer dereference in the Linux kernel USB Type-C TI Power Delivery (tipd) driver allows a local low-privileged user to crash the kernel (denial of service) on systems with TI CD321x or TPS6598x USB Type-C controller hardware. The flaw in cd321x_update_work() at drivers/usb/typec/tipd/core.c:827 logs a warning when typec_register_partner() fails but omits an early return, causing a subsequent unconditional dereference of the error pointer via typec_partner_set_identity(). No public exploit code has been identified at time of analysis, EPSS probability is 0.17% (6th percentile), and the vulnerability is not listed in CISA KEV.

Technical ContextAI

The vulnerability is in the Linux kernel's drivers/usb/typec/tipd/core.c, part of the TI Power Delivery (tipd) driver that manages TPS6598x and CD321x USB Type-C Power Delivery controllers. The function cd321x_update_work() calls typec_register_partner(), which follows the standard Linux kernel error-pointer convention by returning a pointer encoded with ERR_PTR() on failure. CWE-476 (NULL Pointer Dereference) applies here: after checking IS_ERR(tps->partner) and emitting a dev_warn, the code lacks a return statement and falls through to call typec_partner_set_identity(tps->partner), dereferencing an invalid address and triggering a kernel oops or panic. The bug was detected by the Smatch static analysis tool. The fix adds a missing early return after the error check and corrects a typo ('partnet' → 'partner') in the warning message. CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to Linux kernel 6.18.33, 7.0.10, or 7.1, which contain the upstream fix. The exact patch commits for stable branches are available at https://git.kernel.org/stable/c/f2529d08fcb429ea01bb87c326342f41483f8b2f, https://git.kernel.org/stable/c/9e31082f92c913d74fefb4e60cd0284e605ba3a3, and https://git.kernel.org/stable/c/19951118fb22b5ad512379ee64510fe0e2c40eb3. As a compensating control on systems that do not require USB Type-C Power Delivery via TI hardware, blacklisting or unloading the tipd kernel module (built via CONFIG_TYPEC_TPS6598X) eliminates the vulnerable code path entirely with no functional impact on systems lacking TI CD321x or TPS6598x hardware; the trade-off is loss of Type-C PD negotiation on affected hardware. Distribution-specific stable kernel packages from vendors such as Red Hat, Debian, Ubuntu, and SUSE should be monitored for backported fixes.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-53028 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy