Skip to main content

Linux Kernel CVE-2026-53344

| EUVDEUVD-2026-40978 MEDIUM
Use of Uninitialized Resource (CWE-908)
2026-07-01 Linux GHSA-7638-fmxx-mr26
Denial Of Service Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local vector confirmed by probe-time trigger; low privileges sufficient; pure availability impact (kernel panic); no confidentiality or integrity exposure.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.1 MEDIUM
AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 23, 2026 - 21:52 vuln.today
CVSS changed
Jul 23, 2026 - 21:38 NVD
5.5 (MEDIUM)
Patch available
Jul 01, 2026 - 15:16 EUVD
CVE Published
Jul 01, 2026 - 13:32 nvd
MEDIUM 5.5
CVE Published
Jul 01, 2026 - 13:32 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init

Regmap initialization triggers regcache_maple_populate() which attempts SPI read to populate cache. SPI read requires mcp->dev and mcp->addr to be set, without them, NULL pointer dereference occurs during probe.

Move initialization before mcp23s08_spi_regmap_init() call.

AnalysisAI

NULL pointer dereference in the Linux kernel's pinctrl mcp23s08 driver (MCP23S08 SPI GPIO expander) crashes the kernel during device probe on systems where mcp->dev and mcp->addr are accessed before initialization. Affected kernels include Linux 6.19 through the fix commits in stable series 7.0.13 and 7.1. A local attacker with low privileges on a system hosting MCP23S08 SPI hardware can trigger a kernel panic (denial of service) by causing driver probe to execute. No active exploitation confirmed (not in CISA KEV) and EPSS sits at 0.14% (4th percentile), reflecting the hardware-specific nature of the exposure.

Technical ContextAI

The Microchip MCP23S08 is an SPI-interfaced GPIO expander supported by the Linux kernel's pinctrl subsystem via drivers/pinctrl/pinctrl-mcp23s08.c. During driver probe, the code calls mcp23s08_spi_regmap_init() to set up a regmap abstraction for register I/O. Regmap initialization internally invokes regcache_maple_populate(), which performs an SPI bus read to pre-populate the register cache. That SPI read path dereferences mcp->dev (the device pointer) and mcp->addr (the SPI chip-select address) before they were assigned, causing a NULL pointer dereference. The root cause maps to CWE-908 (Use of Uninitialized Resource): the driver relied on struct fields being set, but the initialization ordering placed their assignment after the first use. CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers the affected kernel builds from commit f9f4fda15e720686f1b2b436591ab11255e4e85e up to the fix commits.

RemediationAI

Upgrade to Linux 7.0.13 or Linux 7.1, which contain the upstream fix commits 3a13bb9540dfd7014c5601608afcbbadbbcfd673 and 8473c3a197b57ff01396f7a2ec6ddf65383820d4 respectively (https://git.kernel.org/stable/c/3a13bb9540dfd7014c5601608afcbbadbbcfd673, https://git.kernel.org/stable/c/8473c3a197b57ff01396f7a2ec6ddf65383820d4). For systems running Linux 6.19 or intermediate versions that cannot be upgraded immediately, a targeted workaround is to blacklist the mcp23s08 kernel module (add 'blacklist mcp23s08' to /etc/modprobe.d/blacklist.conf and run depmod -a), which prevents the vulnerable probe path from executing entirely. The trade-off is loss of MCP23S08 GPIO expander functionality. If the hardware is not physically present in the deployment, no action is required as the driver will not probe. Distribution-specific stable backports should be monitored via vendor security channels.

Same weakness CWE-908 – Use of Uninitialized Resource

View all
CVE-2011-1255 CRITICAL POC
9.3
CVE-2024-50302 MEDIUM
5.5
CVE-2024-12085 HIGH POC
7.5
CVE-2021-1104 CRITICAL POC
9.8
CVE-2021-29937 CRITICAL POC
9.8
CVE-2021-29936 CRITICAL POC
9.8
CVE-2021-26305 CRITICAL POC
9.8
CVE-2019-9641 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53344 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy