Skip to main content

Linux Kernel CVE-2026-53237

| EUVDEUVD-2026-39328 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-6v4w-qf8x-8hjm
Denial Of Service Linux Null Pointer Dereference
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local authenticated access to Marvell Armada system
  2. Delivery
    Write suspend trigger to /sys/power/state
  3. Exploit
    dpm_suspend_start iterates GPIO bank callbacks
  4. Execution
    mvebu_gpio_suspend calls mvebu_pwm_suspend on NULL-mvpwm bank
  5. Persist
    NULL pointer dereference at regmap_mmio_read
  6. Impact
    Kernel oops crashes system

Vulnerability Assessment

Weakness
CWE
CWE-476
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires local authenticated access with privileges sufficient to write to /sys/power/state (typically root or a user in the power management group). The target system must be running on Marvell Armada 370/XP or compatible Marvell EBU ARM SoC hardware - standard x86, ARM64, or other architectures are entirely unaffected. The GPIO bank layout must include at least one bank without PWM hardware (mvchip->mvpwm == NULL), which is the default configuration for most Armada GPIO banks. The crash occurs during the suspend entry path, not on normal operation, meaning the vulnerability is not triggered by ordinary kernel activity. Limiting factors: hardware-specific (Marvell EBU only), requires local privilege escalation or pre-existing local access, and the attacker gains only a system crash with no data exfiltration or code execution primitive.
Impact

Real-world risk is low despite a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The local attack vector (AV:L) requires either physical access or an authenticated shell session on the target device, and the target hardware must be a Marvell Armada ARM SoC system. The EPSS score of 0.18% at the 7th percentile further confirms minimal exploitation interest from the threat actor community. The vulnerability is absent from CISA KEV, and no public exploit code has been identified. SSVC signals reinforce this: exploitation is not automated (requires deliberate suspend trigger), and technical impact is limited to availability of a single embedded system. The primary risk population is embedded Linux deployments on Armada hardware - IoT gateways, NAS appliances, and industrial controllers - not general-purpose servers or desktops. There is no confidentiality or integrity impact. The CVSS score accurately reflects the technical severity; the limiting factor is the narrow hardware and access prerequisite, making this a maintenance-priority patch rather than an emergency response item.
Exploit ScenarioDerived

An authenticated local user on a Marvell Armada-based embedded Linux device (such as an IoT gateway or NAS appliance) writes 'mem' or 'freeze' to /sys/power/state to initiate a suspend cycle. The kernel's device power management framework iterates all GPIO banks via mvebu_gpio_suspend, calling mvebu_pwm_suspend() for a bank whose mvchip->mvpwm is NULL. The kernel dereferences the NULL pointer at regmap_mmio_read, triggering an ARM Oops (error code 815, PREEMPT ARM) and crashing the system. No exploit code is needed beyond a standard sysfs write.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 08, 2026

NULL pointer dereference in the Linux kernel's Marvell EBU GPIO driver (gpio/mvebu) causes a kernel oops and system crash during suspend/resume operations on Marvell Armada ARM platforms. The flaw affects all stable kernel branches from 4.12 onward where mvebu_pwm_suspend() and mvebu_pwm_resume() are unconditionally invoked for every GPIO bank, including those where mvchip->mvpwm is NULL due to absent PWM hardware. A local authenticated user with sufficient privileges to trigger system suspend can crash the kernel with no recovery, resulting in full availability loss. No public exploit exists and EPSS is 0.18% (7th percentile), reflecting a niche hardware dependency that sharply limits real-world exposure.

RemediationAI

The primary fix is upgrading to a patched kernel stable release: 6.6.143, 6.12.94, 7.0.13, 7.1, or 6.18.36 per EUVD-confirmed patch versions. Upstream fix commits are available directly at https://git.kernel.org/stable/c/4ef24338eda3c7e96d6f94a988266ff16ed3985d, https://git.kernel.org/stable/c/6136c1474db88272231573e222896e1998d34662, https://git.kernel.org/stable/c/7db09011ce62162d72897fc4856b4425245dfe35, https://git.kernel.org/stable/c/b9ad50d7505ebd48282ec3630258dc820fc85c81, and https://git.kernel.org/stable/c/c9677a9274ffb44987ec209dc8ec9f2d34946956 - these may be cherry-picked onto downstream vendor kernels (e.g., Yocto-based builds for Armada). If patching is not immediately feasible, the specific compensating control is to disable system suspend/hibernate on affected Marvell Armada devices by removing or blocking writes to /sys/power/state, which prevents the suspend path from ever invoking the vulnerable mvebu_gpio_suspend callback. This workaround trades power management capability for stability and may affect power consumption in battery-dependent embedded deployments.

Affected VersionsENISA

Linux patch: 6.18.36
Linux patch: 7.1
Linux patch: 6.6.143
Linux 757642f9a584e893f3f4e50c99b674ee8a3ed363 <c9677a9274ffb44987ec209dc8ec9f2d34946956
Linux 757642f9a584e893f3f4e50c99b674ee8a3ed363 <7db09011ce62162d72897fc4856b4425245dfe35
Linux 4.12
Linux patch: 6.12.94
Linux patch: 0
Linux 757642f9a584e893f3f4e50c99b674ee8a3ed363 <4ef24338eda3c7e96d6f94a988266ff16ed3985d
Linux 757642f9a584e893f3f4e50c99b674ee8a3ed363 <6136c1474db88272231573e222896e1998d34662
Linux 757642f9a584e893f3f4e50c99b674ee8a3ed363 <b9ad50d7505ebd48282ec3630258dc820fc85c81
Linux patch: 7.0.13

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected code resides in drivers/gpio/gpio-mvebu.c, the GPIO driver for Marvell EBU (Embedded Business Unit) SoCs such as the Armada 370/XP family (CWE-476: NULL Pointer Dereference). During power management callbacks, the driver iterates over all GPIO banks and calls mvebu_pwm_suspend()/mvebu_pwm_resume() unconditionally. However, only certain GPIO banks expose PWM functionality; banks without PWM have their mvchip->mvpwm pointer left as NULL. When mvebu_pwm_suspend() attempts to read mvpwm->blink_select via regmap_mmio_read, dereferencing the NULL mvpwm pointer triggers a kernel Oops at virtual address 0x00000020 on ARM. The call trace confirms the crash path: ksys_write → state_store → pm_suspend → suspend_devices_and_enter → dpm_suspend_start → dpm_suspend → device_suspend → dpm_run_callback → mvebu_gpio_suspend → regmap_read → regmap_mmio_read. The fix adds a simple NULL guard: if (!mvchip->mvpwm) return early. CPE: cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 5.5 MEDIUM

Local vector because suspend must be triggered by a logged-in user; PR:L since writing to /sys/power/state requires at minimum low privilege; availability-only impact as the result is a kernel crash with no data exposure.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Jul 08, 2026 - 13:22 NVD
5.5 (MEDIUM)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 nvd
MEDIUM 5.5
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

gpio: mvebu: fix NULL pointer dereference in suspend/resume

mvebu_pwm_suspend() and mvebu_pwm_resume() are called for all GPIO banks during suspend/resume, but not all banks have PWM functionality. GPIO banks without PWM have mvchip->mvpwm set to NULL.

Calling mvebu_pwm_suspend() with mvpwm == NULL causes a NULL pointer dereference when it tries to access mvpwm->blink_select.

Unable to handle kernel NULL pointer dereference at virtual address 00000020 when write [00000020] *pgd=00000000 Internal error: Oops: 815 [#1] PREEMPT ARM Modules linked in: CPU: 0 UID: 0 PID: 406 Comm: sh Not tainted 6.12.74-rt12-yocto-standard-g4e96f98fb7db-dirty #353 Hardware name: Marvell Armada 370/XP (Device Tree) PC is at regmap_mmio_read+0x38/0x54 LR is at regmap_mmio_read+0x38/0x54 pc : [<c05fd2ac>] lr : [<c05fd2ac>] psr: 200f0013 sp : f0c11d10 ip : 00000000 fp : c100d2f0 r10: c14fb854 r9 : 00000000 r8 : 00000000 r7 : c1799c00 r6 : 00000020 r5 : 00000020 r4 : c179c7c0 r3 : f0a231a0 r2 : 00000020 r1 : 00000020 r0 : 00000000 Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 10c5387d Table: 135ec059 DAC: 00000051 Call trace: regmap_mmio_read from _regmap_bus_reg_read+0x78/0xac _regmap_bus_reg_read from _regmap_read+0x60/0x154 _regmap_read from regmap_read+0x3c/0x60 regmap_read from mvebu_gpio_suspend+0xa4/0x14c mvebu_gpio_suspend from dpm_run_callback+0x54/0x180 dpm_run_callback from device_suspend+0x124/0x630 device_suspend from dpm_suspend+0x124/0x270 dpm_suspend from dpm_suspend_start+0x64/0x6c dpm_suspend_start from suspend_devices_and_enter+0x140/0x8e8 suspend_devices_and_enter from pm_suspend+0x2fc/0x308 pm_suspend from state_store+0x6c/0xc8 state_store from kernfs_fop_write_iter+0x10c/0x1f8 kernfs_fop_write_iter from vfs_write+0x270/0x468 vfs_write from ksys_write+0x70/0xf0 ksys_write from ret_fast_syscall+0x0/0x54

Add a NULL check for mvchip->mvpwm before calling the PWM suspend/resume functions.

Threat Intelligence Overview

EPSS Score
0.2%
Top 93% exploitable
Prevalence
Low
Marvell Armada ARM SoC, primarily niche embedded/IoT deployments
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2020-1967 HIGH POC
7.5
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2021-3449 MEDIUM
5.9
CVE-2015-3194 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53237 ADVISORY https://ubuntu.com/security/notices/USN-8726-1 ADVISORY https://ubuntu.com/security/notices/USN-8727-1 ADVISORY https://vuldb.com/vuln/373765 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3130/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3166/ REF https://git.kernel.org/stable/c/3cb53f89049c3769e102ac5b7692e679a1d45510 REF https://git.kernel.org/stable/c/4ef24338eda3c7e96d6f94a988266ff16ed3985d REF https://git.kernel.org/stable/c/6136c1474db88272231573e222896e1998d34662 REF https://git.kernel.org/stable/c/7db09011ce62162d72897fc4856b4425245dfe35 REF https://git.kernel.org/stable/c/b9ad50d7505ebd48282ec3630258dc820fc85c81 REF https://git.kernel.org/stable/c/c9677a9274ffb44987ec209dc8ec9f2d34946956

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy