Skip to main content

Linux Kernel CVE-2026-53158

| EUVDEUVD-2026-39249 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-j24m-w36c-325g
Denial Of Service Linux Null Pointer Dereference Red Hat Suse
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Boot on Qualcomm SoC hardware
  2. Delivery
    DSP sends glink message during probe window
  3. Exploit
    fastrpc_rpmsg_callback fires with NULL cctx
  4. Execution
    spinlock acquired on NULL pointer at 0x178
  5. Persist
    kernel NULL pointer dereference panic
  6. Impact
    system crash (DoS)

Vulnerability Assessment

Weakness
CWE
CWE-476
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires: (1) the target system must use a Qualcomm SoC with a DSP subsystem communicating over GLINK SMEM transport (e.g., Snapdragon platforms); (2) the Linux kernel must be built with the fastrpc driver (CONFIG_QCOM_FASTRPC) loaded or compiled in; (3) the race window must be hit - the DSP must send a glink message during the fastrpc_rpmsg_probe() initialization window, which occurs naturally on affected hardware at boot. No attacker interaction is required to trigger this on vulnerable hardware; it manifests as a boot-time crash. Exploitation is inherently limited to Qualcomm DSP hardware environments; the code path does not exist on x86, ARM without Qualcomm DSP, or any system not using the GLINK SMEM transport. Remote exploitation is not possible.
Impact

Real-world risk is low-to-moderate and very narrowly scoped. CVSS 5.5 (AV:L/AC:L/PR:L) with availability-only impact accurately reflects a local DoS confined to Qualcomm DSP-bearing hardware. EPSS at 0.17% (6th percentile) signals negligible exploitation interest from the broader threat landscape, consistent with a race condition that naturally triggers on vulnerable hardware at boot rather than being weaponized by external actors. There is no KEV listing and no public exploit. The practical risk is primarily a reliability/stability concern for Qualcomm SoC platforms - the DSP sending a glink message during the probe window is not an adversarial action but normal hardware behavior. Defenders managing Qualcomm-based Linux devices (Android, embedded automotive, IoT) should prioritize patching as a stability fix; general-purpose server and desktop Linux environments are unaffected by this code path entirely.
Exploit ScenarioDerived

On a Qualcomm SoC-based Linux system (e.g., an Android device, automotive platform, or embedded board), the DSP hardware sends a GLINK initialization message during boot before the fastrpc_rpmsg_probe() routine has finished setting driver data. The kernel's fastrpc_rpmsg_callback() fires, calls dev_get_drvdata() which returns NULL, then attempts to acquire a spinlock at offset 0x178 of the NULL pointer, triggering a kernel NULL pointer dereference and system panic. No public exploit code exists; the condition is triggered by normal DSP hardware behavior on vulnerable kernel versions.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 07, 2026

NULL pointer dereference in the Linux kernel's fastrpc misc driver crashes the kernel when a Qualcomm DSP sends a glink message before the fastrpc_rpmsg_probe() initialization routine completes. Systems using the Qualcomm FastRPC subsystem - primarily Android and embedded Qualcomm SoC platforms running Linux 5.1 through unpatched 6.x/7.x stable branches - are vulnerable to a local denial-of-service (kernel panic) at boot. No public exploit exists and EPSS is 0.17% (6th percentile), consistent with a hardware-timing race condition requiring specific Qualcomm DSP hardware rather than generic remote exploitation.

RemediationAI

The primary fix is upgrading to a patched Linux kernel stable release: 6.6.143, 6.12.94, 6.18.36, 7.0.13, or 7.1. Upstream fix commits are available at https://git.kernel.org/stable/c/4bfdf0a9855df55e9e031ca6a25b855820590c70, https://git.kernel.org/stable/c/8fb4a23df5b7c02929b62e5dbc270ec7c42b8134, https://git.kernel.org/stable/c/d5de9cb5355db36438edc621dde3673e3f235767, https://git.kernel.org/stable/c/5401fb4fe10fac6134c308495df18ed74aebb9c4, and https://git.kernel.org/stable/c/d77583ca33299fede0c194744ef2284e7ba5b763. The fix restructures fastrpc_rpmsg_probe() to complete all fastrpc_channel_ctx initialization before calling dev_set_drvdata(), and adds a NULL guard in fastrpc_rpmsg_callback(). If immediate patching is not feasible, a compensating control on systems where the fastrpc driver is not required is to blacklist the fastrpc kernel module (echo 'blacklist fastrpc' >> /etc/modprobe.d/fastrpc-blacklist.conf), though this disables DSP-accelerated offload functionality entirely. This workaround is not applicable to Android platforms where the DSP is required for core functionality.

Affected VersionsENISA

Linux f6f9279f2bf0e37e2f1fb119d8832b8568536a04 <8fb4a23df5b7c02929b62e5dbc270ec7c42b8134
Linux f6f9279f2bf0e37e2f1fb119d8832b8568536a04 <4bfdf0a9855df55e9e031ca6a25b855820590c70
Linux patch: 7.0.13
Linux patch: 6.12.94
Linux 5.1
Linux patch: 6.18.36
Linux patch: 6.6.143
Linux f6f9279f2bf0e37e2f1fb119d8832b8568536a04 <d5de9cb5355db36438edc621dde3673e3f235767
Linux f6f9279f2bf0e37e2f1fb119d8832b8568536a04 <5401fb4fe10fac6134c308495df18ed74aebb9c4
Linux f6f9279f2bf0e37e2f1fb119d8832b8568536a04 <d77583ca33299fede0c194744ef2284e7ba5b763
Linux patch: 7.1
Linux patch: 0

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The Qualcomm FastRPC (fastrpc) driver in the Linux kernel misc subsystem enables remote procedure calls between the application processor and Qualcomm DSP cores via the GLINK SMEM transport layer. The vulnerability is a classic TOCTOU initialization race: two distinct windows exist - (1) dev_set_drvdata() is called before spin_lock_init() and idr_init() complete on the fastrpc_channel_ctx structure, leaving a period where a retrieved cctx pointer points to an incompletely initialized spinlock at offset 0x178; (2) the rpmsg channel becomes live as soon as the driver binds, so the DSP can fire fastrpc_rpmsg_callback() before dev_set_drvdata() is called at all, returning NULL from dev_get_drvdata(). CWE-476 (NULL Pointer Dereference) is the root cause, compounded by CWE-362 (race condition). Affected CPE: cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* across multiple stable series introduced at commit f6f9279f2bf0e.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 5.5 MEDIUM

Local vector because the fastrpc driver and DSP hardware must be physically present; PR:L because the crash path is triggered by kernel-level DSP messaging, not arbitrary unprivileged action; A:H for kernel panic; no C or I impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 4.1 MEDIUM
AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Jul 07, 2026 - 18:52 NVD
5.5 (MEDIUM)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 nvd
MEDIUM 5.5
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

misc: fastrpc: Fix NULL pointer dereference in rpmsg callback

A NULL pointer dereference was observed on Hawi at boot when the DSP sends a glink message before fastrpc_rpmsg_probe() has completed initialization:

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000178 pc : _raw_spin_lock_irqsave+0x34/0x8c lr : fastrpc_rpmsg_callback+0x3c/0xcc [fastrpc] ... Call trace: _raw_spin_lock_irqsave+0x34/0x8c (P) fastrpc_rpmsg_callback+0x3c/0xcc [fastrpc] qcom_glink_native_rx+0x538/0x6a4 qcom_glink_smem_intr+0x14/0x24 [qcom_glink_smem]

The faulting address 0x178 corresponds to the lock variable inside struct fastrpc_channel_ctx, confirming that cctx is NULL when fastrpc_rpmsg_callback() attempts to take the spinlock.

There are two issues here. First, dev_set_drvdata() is called before spin_lock_init() and idr_init(), leaving a window where the callback can retrieve a valid cctx pointer but operate on an uninitialized spinlock. Second, the rpmsg channel becomes live as soon as the driver is bound, so fastrpc_rpmsg_callback() can fire before dev_set_drvdata() is called at all, resulting in dev_get_drvdata() returning NULL.

Fix both issues by moving all cctx initialization ahead of dev_set_drvdata() so the structure is fully initialized before it becomes visible to the callback, and add a NULL check in fastrpc_rpmsg_callback() as a guard against any remaining window.

Threat Intelligence Overview

EPSS Score
0.2%
Top 94% exploitable
Prevalence
Medium
Qualcomm SoC Linux deployments - Android, embedded, automotive
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2020-1967 HIGH POC
7.5
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2021-3449 MEDIUM
5.9
CVE-2015-3194 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53158 ADVISORY https://ubuntu.com/security/notices/USN-8726-1 ADVISORY https://ubuntu.com/security/notices/USN-8727-1 ADVISORY https://vuldb.com/vuln/373708 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3130/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3166/ REF https://git.kernel.org/stable/c/0d8c64511fd45690c5326f013710efcb4f73a97e REF https://git.kernel.org/stable/c/150bf6f1193c69252580c19d3b3cd631ddce61d7 REF https://git.kernel.org/stable/c/4bfdf0a9855df55e9e031ca6a25b855820590c70 REF https://git.kernel.org/stable/c/5401fb4fe10fac6134c308495df18ed74aebb9c4 REF https://git.kernel.org/stable/c/8fb4a23df5b7c02929b62e5dbc270ec7c42b8134 REF https://git.kernel.org/stable/c/a3d91218ccca1e990bfb737b5a6da23f0afba22b REF https://git.kernel.org/stable/c/d5de9cb5355db36438edc621dde3673e3f235767 REF https://git.kernel.org/stable/c/d77583ca33299fede0c194744ef2284e7ba5b763

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy