Skip to main content

Linux Kernel CVE-2026-53066

| EUVDEUVD-2026-38934 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-06-24 Linux GHSA-7qff-cmg5-8pwm
Denial Of Service Linux Null Pointer Dereference Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access with low privilege required to reach the DRM subsystem; crash-only impact with no data disclosure or integrity effect justifies C:N/I:N.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 21, 2026 - 20:01 vuln.today
CVSS changed
Jul 21, 2026 - 17:52 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 16:30 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

drm/sun4i: backend: fix error pointer dereference

The function drm_atomic_get_plane_state() can return an error pointer and is not checked for it. Add error pointer check.

Detected by Smatch: drivers/gpu/drm/sun4i/sun4i_backend.c:496 sun4i_backend_atomic_check() error: 'plane_state' dereferencing possible ERR_PTR()

AnalysisAI

Kernel panic via unchecked error pointer dereference in the Linux kernel's drm/sun4i display backend driver affects Allwinner SoC-based systems running kernel versions from 4.17 up to the patched releases. In sun4i_backend_atomic_check() at drivers/gpu/drm/sun4i/sun4i_backend.c:496, the return value of drm_atomic_get_plane_state() is not validated against IS_ERR() before dereference, allowing a local low-privilege user to crash the kernel. No active exploitation is confirmed (not in CISA KEV), and the EPSS score of 0.16% (6th percentile) reflects negligible real-world exploitation interest.

Technical ContextAI

The sun4i DRM (Direct Rendering Manager) subsystem is the Linux kernel driver for Allwinner SoC display hardware, used in ARM single-board computers such as Orange Pi and Banana Pi platforms. The vulnerable code path is in sun4i_backend_atomic_check() (drivers/gpu/drm/sun4i/sun4i_backend.c:496), where drm_atomic_get_plane_state() is called without checking whether the returned pointer is an ERR_PTR using the IS_ERR() macro - a standard Linux kernel idiom for error propagation via pointers. CWE-476 (NULL Pointer Dereference) governs this root cause class: while the value is technically an ERR_PTR rather than NULL, dereferencing it causes an invalid kernel memory access and subsequent kernel panic. The flaw was detected through static analysis by Smatch, a kernel-specific C checker. CPE data (cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*) covers all Linux kernel versions, but exploitability is hardware-gated to systems loading the sun4i_drv module.

RemediationAI

Upgrade to a patched Linux kernel stable release: 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1. Stable git commits for each branch are available at https://git.kernel.org/stable/c/ea51fd96aca01381e8f1ac0c671a57b7619193bb and the other kernel.org references provided. Ubuntu users should apply the updates published under USN-8566-1 (https://ubuntu.com/security/notices/USN-8566-1), USN-8567-1, and USN-8568-1. If immediate patching is not feasible on affected Allwinner SoC systems, blacklisting the sun4i_drv kernel module (e.g., adding 'blacklist sun4i-drv' to /etc/modprobe.d/) prevents the vulnerable code path from loading; however, this disables display output on affected hardware entirely. Restricting local user access to DRM device nodes (/dev/dri/*) via group permissions reduces exposure to unprivileged triggering while preserving display functionality for authorized users.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed

Share

CVE-2026-53066 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy