Skip to main content

Linux Kernel CVE-2026-53278

| EUVDEUVD-2026-39883 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-06-26 Linux GHSA-hfvr-wfpf-26r6
Linux Denial Of Service Null Pointer Dereference Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access required; low-privilege user can trigger teardown path; no C/I impact, only kernel crash (availability high).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 08, 2026 - 04:18 vuln.today
CVSS changed
Jul 08, 2026 - 04:07 NVD
5.5 (MEDIUM)
Patch available
Jun 26, 2026 - 21:02 EUVD
CVE Published
Jun 26, 2026 - 19:40 nvd
MEDIUM 5.5
CVE Published
Jun 26, 2026 - 19:40 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

arm_mpam: Check whether the config array is allocated before destroying it

__destroy_component_cfg() is called to free the configuration array. It uses the embedded 'garbage' structure, which means the array has to be allocated.

If __destroy_component_cfg() is called from mpam_disable() before the configuration was ever allocated, then a NULL pointer is dereferenced.

Check for this case and return early if the configuration is not allocated.

__destroy_component_cfg() also frees the mbwu_state as this is allocated by __allocate_component_cfg(). As the mbwu_state is allocated after comp->cfg is set, and is also under mpam_list_lock, only the first pointer needs checking.

AnalysisAI

NULL pointer dereference in the Linux kernel arm_mpam subsystem allows a local low-privileged attacker to crash the kernel by triggering a specific cleanup code path before initialization completes. The flaw exists in __destroy_component_cfg(), which unconditionally dereferences the embedded 'garbage' structure to free the configuration array even when mpam_disable() is called before __allocate_component_cfg() has ever run. No public exploit code exists and the EPSS score of 0.15% (5th percentile) confirms negligible real-world exploitation activity; vendor-supplied patches are available via upstream stable commits.

Technical ContextAI

The ARM Memory Partitioning and Monitoring (MPAM) subsystem manages cache and memory bandwidth partitioning on ARM processors that implement the MPAM architectural extension (found in server-class ARM SoCs). The vulnerable function __destroy_component_cfg() uses the embedded 'garbage' field - part of the component configuration structure - to locate and free the dynamically allocated configuration array and associated mbwu_state. If mpam_disable() invokes this teardown path before __allocate_component_cfg() has executed (setting comp->cfg), the pointer is NULL and a kernel NULL pointer dereference occurs. The fix adds an early NULL check against comp->cfg under mpam_list_lock before any dereference. CWE-476 (NULL Pointer Dereference) describes this class: a cleanup path assumes an initialization invariant that is not always upheld, and no guard exists for the uninitialized case. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

Apply the upstream stable patches available at https://git.kernel.org/stable/c/8eb6dc76eeae5302c0d885906a0e469ef9630a59 and https://git.kernel.org/stable/c/6ccbb613b42a1f1ba7bfd547a148f644a902a25c. These commits introduce a NULL check on comp->cfg before __destroy_component_cfg() proceeds with teardown, covering the uninitialized case. Linux distribution vendors (RHEL, Ubuntu, SUSE, Debian) should be monitored for downstream backport availability specific to their supported kernel versions, as the exact patched release version per distribution has not been independently confirmed from available data. As a compensating control for systems where immediate patching is not feasible, disabling or blacklisting the arm_mpam kernel module (if compiled as a module) will prevent the vulnerable code path from executing, at the cost of losing ARM memory bandwidth and cache partitioning functionality. Systems not running ARM MPAM-capable hardware have no exposure and require no action.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2026-53278 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy