Skip to main content

Linux Kernel CVE-2026-53307

| EUVDEUVD-2026-39842 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-06-26 Linux GHSA-4qpg-p2c6-564v
Denial Of Service Linux Null Pointer Dereference Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

AC:H reflects the specific DT configuration prerequisite (empty pinmux property on a pinctrl-using platform); otherwise metrics align with NVD assessment.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 06, 2026 - 20:31 vuln.today
CVSS changed
Jul 06, 2026 - 20:22 NVD
5.5 (MEDIUM)
Patch available
Jun 26, 2026 - 21:02 EUVD
CVE Published
Jun 26, 2026 - 19:41 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 26, 2026 - 19:41 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: pinconf-generic: Fully validate 'pinmux' property

The pinconf_generic_parse_dt_pinmux() assumes that the 'pinmux' property is not empty when present. This might be not true. With that, the allocator will give a special value in return and not NULL which lead to the crash when trying to access that (invalid) memory. Fix that by fully validating 'pinmux' value, including its length.

AnalysisAI

Null pointer dereference in the Linux kernel's pinctrl subsystem allows a local low-privileged attacker to crash the kernel, causing a denial of service. The flaw exists in pinconf_generic_parse_dt_pinmux(), which fails to validate that a 'pinmux' Device Tree property is non-empty before use - an empty property causes the allocator to return an invalid non-NULL pointer, and subsequent memory access triggers a kernel panic. No public exploit code exists and EPSS is 0.15% (5th percentile), reflecting low real-world exploitation probability; exploitation is further constrained to systems with specific pinctrl hardware and Device Tree configurations.

Technical ContextAI

The affected component is the Linux kernel's pin control (pinctrl) subsystem, specifically the pinconf_generic_parse_dt_pinmux() function in drivers/pinctrl/pinconf-generic.c, responsible for parsing Device Tree (DT) 'pinmux' properties at kernel initialization. The root cause is CWE-476 (NULL Pointer Dereference): when a 'pinmux' DT property exists but contains zero-length data, the kernel allocator returns a non-NULL sentinel value rather than NULL, bypassing NULL checks. The function then attempts to dereference this invalid pointer, causing a kernel panic. Affected CPE is cpe:2.3:a:linux:linux. The vulnerability is present in kernels from commit 7112c05fff83e15726dd60a10248b76474e3cdf9 through the backport fix commits across stable branches. This subsystem is active on any platform using DT-based pinctrl (ARM, ARM64, RISC-V embedded/SoC platforms primarily).

RemediationAI

Apply the vendor-released stable-branch patches: upgrade to Linux 6.18.33 (fix commit c98324ea7849b6e5baa1774f71709b375a2c2f9e), Linux 7.0.10 (fix commit b7842b722169359e7ffe4b838d2496e9e72ac996), or Linux 7.1+ (fix commit b7842b722169359e7ffe4b838d2496e9e72ac996), all available at https://git.kernel.org/stable/. For systems where kernel upgrade is not immediately feasible, a compensating control is to audit and sanitize Device Tree source files to ensure no 'pinmux' properties are present with zero-length values - this prevents the crash at source without code changes, though it requires DT build tooling access. Disabling or blacklisting the affected pinctrl driver module is not practical on embedded platforms where it is required for hardware function. Distribution-specific updates (Debian, Ubuntu, RHEL, etc.) should be monitored for backported patches to their supported kernel versions.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-53307 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy