Skip to main content

Linux Kernel CVE-2026-53291

| EUVDEUVD-2026-39896 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-06-26 Linux GHSA-7qh4-cc67-w444
Linux Denial Of Service Null Pointer Dereference Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

Triggering the vulnerable path requires inducing a memory allocation failure during driver probe - a non-default, resource-exhaustion condition - warranting AC:H over the NVD-assigned AC:L; all other metrics align with the description.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 08, 2026 - 04:31 vuln.today
CVSS changed
Jul 08, 2026 - 04:07 NVD
5.5 (MEDIUM)
Patch available
Jun 26, 2026 - 21:02 EUVD
CVE Published
Jun 26, 2026 - 19:40 nvd
MEDIUM 5.5
CVE Published
Jun 26, 2026 - 19:40 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

ALSA: hda/conexant: Fix missing error check for jack detection

In cx_probe(), the return value of snd_hda_jack_detect_enable_callback() is ignored. This function returns a pointer, and if it fails (e.g., due to memory allocation failure), it returns an error pointer which must be checked using IS_ERR().

If the registration fails, the driver continues to probe, but the jack detection callback will not be registered. This can lead to a kernel crash later when the driver attempts to handle jack events or accesses the uninitialized structure.

Check the return value using IS_ERR() and propagate the error via PTR_ERR() to the probe caller.

AnalysisAI

Kernel crash via NULL pointer dereference in the ALSA HDA Conexant audio driver affects Linux kernel stable branches from 5.15 through 7.0, exploitable by a local low-privileged user on systems with Conexant HDA audio hardware. The cx_probe() function ignores the error pointer returned by snd_hda_jack_detect_enable_callback() on memory allocation failure, leaving the jack detection callback unregistered and an internal structure uninitialized; a subsequent audio jack event then triggers a kernel panic. No public exploit exists and no CISA KEV listing is present; EPSS is 0.17% (7th percentile), confirming very low real-world exploitation probability.

Technical ContextAI

The vulnerable code resides in the ALSA (Advanced Linux Sound Architecture) High Definition Audio subsystem's Conexant codec driver (sound/pci/hda/patch_conexant.c). The function snd_hda_jack_detect_enable_callback() follows the kernel's ERR_PTR convention - on failure it returns an error-encoded pointer that must be tested with IS_ERR() before use. cx_probe() silently discards this return value, so when a memory allocation failure occurs during driver initialization, the jack detection callback is never registered but no error is propagated to the caller. CWE-476 (NULL Pointer Dereference) characterizes this root cause: a later jack event causes the driver to dereference the uninitialized structure, resulting in a kernel oops or panic. CPE cpe:2.3:a:linux:linux covers all affected kernel versions across every architecture that loads the snd_hda_codec_conexant module.

RemediationAI

The primary fix is to upgrade to a patched Linux kernel stable release: 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1, whichever matches your active branch. Upstream patches are available at https://git.kernel.org/stable/c/49c2c5924552e1d2f8b635dee663abebbb7cf63b (and the six additional sibling commits listed in the references) and can be backported by distribution maintainers. For systems where a kernel update cannot be applied immediately and that do not require Conexant HDA audio functionality, a compensating control is to blacklist the snd_hda_codec_conexant kernel module by adding 'blacklist snd_hda_codec_conexant' to a file under /etc/modprobe.d/ and rebuilding initramfs; this eliminates the vulnerable code path at the cost of disabling Conexant audio output and input. Systems without Conexant HDA audio hardware are not affected and require no action. Distribution-specific advisories (Debian, Ubuntu, Red Hat, SUSE) should be consulted for packaged kernel update availability.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53291 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy