Skip to main content

Linux Kernel CVE-2026-53299

| EUVDEUVD-2026-39834 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-06-26 Linux GHSA-cpq4-x345-qfwq
Denial Of Service Linux Null Pointer Dereference Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local-only driver bug triggered by allocation failure; PR:L as standard user can influence memory pressure; pure availability impact, no data exposure or integrity effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.4 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 08, 2026 - 03:54 vuln.today
CVSS changed
Jul 08, 2026 - 03:52 NVD
5.5 (MEDIUM)
Patch available
Jun 26, 2026 - 21:02 EUVD
CVE Published
Jun 26, 2026 - 19:40 nvd
MEDIUM 5.5
CVE Published
Jun 26, 2026 - 19:40 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

net: airoha: Move ndesc initialization at end of airoha_qdma_init_tx()

If queue entry list allocation fails in airoha_qdma_init_tx_queue routine, airoha_qdma_cleanup_tx_queue() will trigger a NULL pointer dereference accessing the queue entry array. The issue is due to the early ndesc initialization in airoha_qdma_init_tx_queue(). Fix the issue moving ndesc initialization at end of airoha_qdma_init_tx routine.

AnalysisAI

NULL pointer dereference in the Linux kernel's Airoha QDMA network driver causes a kernel panic (denial of service) when queue entry list allocation fails during TX queue initialization. Systems running Airoha-based network hardware on affected kernel versions - including Linux 6.19 - are vulnerable when the driver's cleanup path dereferences an uninitialized descriptor array pointer. No public exploit exists and EPSS sits at 0.17% (6th percentile), indicating minimal real-world exploitation activity; no CISA KEV listing.

Technical ContextAI

The affected code is in net/airoha, the Linux kernel driver for Airoha EN7500-series SoC network hardware, commonly found in embedded routers and networking equipment. The root cause (CWE-476: NULL Pointer Dereference) is a sequencing error in airoha_qdma_init_tx_queue(): the ndesc (descriptor count) field is initialized before the queue entry array is allocated. If that allocation subsequently fails, the error-path cleanup function airoha_qdma_cleanup_tx_queue() iterates over descriptors using ndesc while the entry array pointer remains NULL, triggering a kernel NULL pointer dereference. The fix relocates ndesc initialization to the end of the routine, after all allocations succeed. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*. This is a kernel-space vulnerability with direct availability impact on the host system.

RemediationAI

The primary fix is to update the Linux kernel to version 7.0.10 or 7.1, which include the corrected ndesc initialization sequencing. For stable branch users, apply the relevant backport commits from kernel.org stable trees (https://git.kernel.org/stable/c/f329924bb49458c65297f1361f545816a5b90998, https://git.kernel.org/stable/c/90619fdedfb9cc8a80f217d882ee7a84d3703e72, https://git.kernel.org/stable/c/ece31f9dae0c3cd3277e66667e7b8ab2577cf34a). If immediate patching is not feasible and the Airoha driver is not required on the affected system, blacklisting the airoha kernel module (echo 'blacklist airoha' >> /etc/modprobe.d/airoha-blacklist.conf) prevents the driver from loading, eliminating exposure with the trade-off of disabling Airoha network hardware. This workaround is only viable on systems where the Airoha NIC is non-essential.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-53299 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy