Skip to main content

Linux Kernel CVE-2026-53042

| EUVDEUVD-2026-38910 MEDIUM
Access of Uninitialized Pointer (CWE-824)
2026-06-24 Linux GHSA-q56q-rvw2-p4r2
Memory Corruption Linux Denial Of Service Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local deterministic crash requiring low privilege and CXL hardware; no confidentiality or integrity impact, only kernel availability loss.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 22, 2026 - 20:48 vuln.today
CVSS changed
Jul 14, 2026 - 19:38 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:29 nvd
MEDIUM 5.5
CVE Published
Jun 24, 2026 - 16:29 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal

CXL is linked before fwctl in drivers/Makefile. Both use module_init, so cxl_pci_driver_init() runs first. When cxl_pci_probe() calls fwctl_register() and then device_add(), fwctl_class is not yet registered because fwctl_init() hasn't run, causing class_to_subsys()` to return NULL and skip knode_class initialization.

On device removal, class_to_subsys() returns non-NULL, and device_del() calls klist_del() on the uninitialized knode, triggering a NULL pointer dereference.

AnalysisAI

NULL pointer dereference in the Linux kernel's fwctl subsystem allows a local low-privilege user to crash the kernel when CXL memory expansion hardware is present and a device removal is triggered. The defect stems from a deterministic module initialization ordering race between the CXL and fwctl drivers, leaving knode_class uninitialized at device registration time and causing device_del() to dereference it fatally on removal. No public exploit identified at time of analysis; EPSS of 0.17% (6th percentile) reflects very low exploitation probability consistent with the local-only attack surface.

Technical ContextAI

The vulnerability (CWE-824: Access of Uninitialized Pointer) lives at the intersection of the Linux kernel's fwctl subsystem and the CXL (Compute Express Link) PCIe memory-expansion driver stack. Both drivers use module_init(), and since CXL is listed before fwctl in drivers/Makefile, cxl_pci_driver_init() executes first. When cxl_pci_probe() calls fwctl_register() and then device_add(), fwctl_class has not yet been registered by the as-yet-unrun fwctl_init(). As a result, class_to_subsys() returns NULL and knode_class initialization is silently skipped. Later, on device removal, class_to_subsys() unexpectedly returns non-NULL, and device_del() calls klist_del() against the uninitialized knode, producing a NULL pointer dereference kernel panic. The affected CPE is cpe:2.3:a:linux:linux:* across all branches containing the vulnerable ordering from commit 858ce2f56b5253063f61f6b1c58a6dbf5d71da0b onward until the respective fix commits.

RemediationAI

The primary fix is to upgrade to Linux 7.0.10, Linux 6.18.33, or any 7.1+ mainline build that incorporates the ordering correction. Upstream fix commits are available at https://git.kernel.org/stable/c/a55f80233f384dc89ef3425b2e1dd0e6d44bcf29, https://git.kernel.org/stable/c/a28f56988c8e5bb9375806a5cfb0bf54d662ae3f, and https://git.kernel.org/stable/c/1075f2f590fdac147f8b8010c35b606564b5c7d7. Ubuntu users should apply updates per USN-8568-1 and USN-8566-1. As a compensating control on systems where a kernel upgrade is not immediately feasible, the cxl_pci module can be blocklisted in modprobe configuration (echo 'blacklist cxl_pci' >> /etc/modprobe.d/cxl-blocklist.conf) to prevent the vulnerable probe path from executing - note this disables all CXL memory expansion functionality and will reduce available memory capacity on CXL-equipped systems. Systems without CXL hardware require no action.

Same weakness CWE-824 – Access of Uninitialized Pointer

View all
CVE-2015-1770 HIGH
8.8
CVE-2016-4343 HIGH POC
8.8
CVE-2020-25573 CRITICAL POC
9.8
CVE-2018-11743 CRITICAL POC
9.8
CVE-2018-9948 MEDIUM POC
6.5
CVE-2018-19857 CRITICAL POC
9.1
CVE-2018-3842 HIGH POC
8.8
CVE-2018-16522 HIGH POC
8.1

Same technique Memory Corruption

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-53042 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy