Skip to main content

Linux Kernel CVE-2026-53152

| EUVDEUVD-2026-39243 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-38rg-2rjc-3rmj
Linux Denial Of Service Null Pointer Dereference Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local vector confirmed by driver/hardware scope; PR:L reflects that a logged-in session or boot context is needed; no C or I impact applies.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 06, 2026 - 17:55 vuln.today
CVSS changed
Jul 06, 2026 - 17:52 NVD
5.5 (MEDIUM)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 nvd
MEDIUM 5.5
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

mmc: dw_mmc-rockchip: Add missing private data for very old controllers

The really old controllers (rk2928, rk3066, rk3188) do not support UHS speeds at all, and thus never handled phase data.

For that reason it never had a parse_dt callback and no driver private data at all.

Commit ff6f0286c896 ("mmc: dw_mmc-rockchip: Add memory clock auto-gating support") makes the private data sort of mandatory, because the init function checks whether phases are configured internally or through the clock controller.

This results in the old SoCs then experiencing NULL-pointer dereferences when they try to access that private-data struct.

While we could have if (priv) conditionals in all places, it's way less cluttery to just give the old types their private-data struct.

AnalysisAI

NULL pointer dereference in the Linux kernel's dw_mmc-rockchip MMC driver triggers kernel panics on systems running legacy Rockchip SoCs (rk2928, rk3066, rk3188) when the MMC subsystem initializes. Commit ff6f0286c896 introduced a mandatory private-data access path that was never populated for these old controllers - which historically had no UHS support and no parse_dt callback - causing a reproducible kernel crash on affected hardware. No active exploitation is confirmed (absent from CISA KEV), and the EPSS score of 0.17% (6th percentile) reflects negligible real-world exploitation probability; the primary risk is an accidental reliability failure on embedded systems running these legacy SoCs.

Technical ContextAI

The dw_mmc-rockchip driver is the Rockchip-specific platform driver for the Synopsys DesignWare MMC/SD host controller. Legacy Rockchip SoCs - rk2928, rk3066, and rk3188 - predate UHS speed support, so they never required phase calibration data, had no parse_dt callback, and had no driver private data struct allocated at probe time. Commit ff6f0286c896 ('mmc: dw_mmc-rockchip: Add memory clock auto-gating support') changed the driver init function to unconditionally dereference the private data pointer to check whether phases are configured internally or through the clock controller. On the three legacy SoC types, this pointer is NULL, producing a CWE-476 NULL Pointer Dereference and an immediate kernel oops/panic. The fix allocates a zero-initialized private data struct for these legacy types so the shared code path always has a valid pointer. Affected CPE is cpe:2.3:o:linux:linux_kernel across multiple stable branches (6.12.x, 6.18.x, 7.0.x, 7.1 RC series) per NVD and EUVD-2026-39243.

RemediationAI

Upgrade the Linux kernel to a patched stable release: 6.12.94 or later for the 6.12.x longterm branch, 6.18.36 or later for the 6.18.x branch, 7.0.13 or later for the 7.0.x branch, or the final 7.1 release for the 7.1 RC series. Fix commits are available from the Linux stable tree at git.kernel.org/stable/c/8d9eca906e76d3dd40e5f2c79701f066678f2e62, git.kernel.org/stable/c/1e9a4850afa0ceb63984fb1a9f3e86d0fc4fd18f, git.kernel.org/stable/c/7f8007be13e6cc1e0a508fe461f9a91ba9a28b8c, and git.kernel.org/stable/c/b1180ff50cca48807893ecde7d1f81d573c88c85. For systems that cannot be immediately patched, blacklisting the dw_mmc_rockchip kernel module (echo 'blacklist dw_mmc_rockchip' >> /etc/modprobe.d/blacklist.conf and rebuilding initramfs) prevents the crash but disables all SD/eMMC functionality on the board - acceptable only where the storage interface is non-essential or handled by another driver. Downstream distribution vendors shipping kernels for ARM/Rockchip targets (Armbian, Debian ARM, Ubuntu ARM) should be monitored for backport availability.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-53152 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy