Skip to main content

Linux Kernel CVE-2026-53348

| EUVDEUVD-2026-40982 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-07-01 Linux GHSA-7gm6-6488-mq68
Denial Of Service Linux Null Pointer Dereference Red Hat Suse Lenovo
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local-only trigger requiring specific audio hardware and probe failure; only impact is kernel panic (availability), with no confidentiality or integrity effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 22, 2026 - 20:46 vuln.today
CVSS changed
Jul 22, 2026 - 19:22 NVD
5.5 (MEDIUM)
Patch available
Jul 01, 2026 - 15:16 EUVD
CVE Published
Jul 01, 2026 - 13:32 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 01, 2026 - 13:32 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions

sdca_dev_unregister_functions() iterates over all SDCA function descriptors and calls sdca_dev_unregister() on each func_dev without checking for NULL. When a function registration has failed partway through, or the device cleanup races with probe deferral, func_dev entries may be NULL, leading to a kernel oops:

BUG: kernel NULL pointer dereference, address: 0000000000000040 RIP: 0010:device_del+0x1e/0x3e0 Call Trace: sdca_dev_unregister_functions+0x37/0x60 [snd_soc_sdca] release_nodes+0x35/0xb0 devres_release_all+0x90/0x100 device_unbind_cleanup+0xe/0x80 device_release_driver_internal+0x1c1/0x200 bus_remove_device+0xc6/0x130 device_del+0x161/0x3e0 device_unregister+0x17/0x60 sdw_delete_slave+0xb6/0xd0 [soundwire_bus] sdw_bus_master_delete+0x1e/0x50 [soundwire_bus] ... sof_probe_work+0x19/0x30 [snd_sof]

This was observed on a Lenovo ThinkPad X1 Carbon G14 (Panther Lake) with the SOF audio driver probe failing due to missing Panther Lake firmware, causing the subsequent cleanup of SoundWire devices to trigger the crash.

Fix this with three changes:

  1. Add a NULL guard in sdca_dev_unregister() so that callers do not

need to pre-validate the pointer (defense in depth).

  1. In sdca_dev_unregister_functions(), skip NULL func_dev entries

and clear func_dev to NULL after unregistration, making the function idempotent and safe against double-invocation.

  1. In sdca_dev_register_functions(), roll back all previously

registered functions when a later one fails, so the function array is never left in a partially-populated state.

AnalysisAI

NULL pointer dereference in the Linux kernel's ASoC SDCA (SoundWire Device Class for Audio) subsystem crashes the kernel during audio device cleanup, resulting in a denial of service. The sdca_dev_unregister_functions() routine iterates over SDCA function descriptors without validating for NULL entries, which can be present when function registration fails partway through or when device cleanup races with probe deferral. This crash was observed in practice on Lenovo ThinkPad X1 Carbon G14 (Panther Lake) systems where missing SOF firmware caused the SOF audio driver probe to fail, triggering the NULL dereference during subsequent SoundWire device teardown. No public exploit exists and EPSS sits at 0.14% (4th percentile), reflecting the hardware-specific and locally-triggered nature of this flaw.

Technical ContextAI

The affected code resides in the Linux kernel's Sound Open Firmware (SOF) audio stack, specifically within the ASoC SDCA subsystem that manages SoundWire Device Class for Audio function registration and teardown. CWE-476 (NULL Pointer Dereference) describes the root cause: sdca_dev_unregister_functions() calls sdca_dev_unregister() on each func_dev pointer without first verifying it is non-NULL. Because sdca_dev_register_functions() previously lacked rollback logic on partial failure, the function array could be left in a partially-populated state with NULL entries for functions that never completed registration. The kernel oops manifests inside device_del() at offset 0x1e, called transitively through the devres cleanup chain (devres_release_all → release_nodes → sdca_dev_unregister_functions). The CPE string cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* confirms this is a mainline Linux kernel defect, not a distribution-specific patch.

RemediationAI

Update to a patched kernel version: Linux 6.19, 7.0.13, or 7.1, which include the three-part fix that adds a NULL guard in sdca_dev_unregister(), skips and clears NULL func_dev entries in sdca_dev_unregister_functions(), and adds rollback logic in sdca_dev_register_functions() on partial failure. The upstream fix commits are available at https://git.kernel.org/stable/c/9a4895059bb6a8505098a9f75de187fd15631fc8 and https://git.kernel.org/stable/c/e4c60a1d4b6ccc66aefb3789cd908d4f9482eefd; distribution vendors (RHEL, Ubuntu, SUSE, Debian) should be monitored for backported stable patches to their respective kernel streams. As a compensating control on systems where patching is not immediately possible, ensuring SOF firmware for the target platform is present (e.g., installing the linux-firmware package) reduces the likelihood of the probe failure that triggers the NULL dereference during cleanup - though this does not eliminate the underlying race condition. Blacklisting the snd_sof or soundwire_bus kernel modules on systems without SoundWire audio hardware is also an option, with the trade-off of disabling all associated audio functionality.

More in Lenovo

View all
CVE-2017-5638 CRITICAL POC
9.8 Mar 11

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
CVE-2012-1195 HIGH POC
7.5 Feb 18

Unrestricted file upload vulnerability in andesk/managementsuite/core/core.anonymous/ServerSetup.asmx in the ServerSetup
CVE-2012-1196 MEDIUM POC
5.0 Feb 18

Directory traversal vulnerability in the VulCore web service (WSVulnerabilityCore/VulCore.asmx) in Lenovo ThinkManagemen
CVE-2015-2219 HIGH POC
7.2 May 12

Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which allo
CVE-2018-14066 CRITICAL POC
9.8 Jul 15

The content://wappush content provider in com.android.provider.telephony, as found in some custom ROMs for Android phone
CVE-2026-58583 HIGH POC
8.4 Jul 07

Local privilege escalation in the FluxInk (formerly Sunia SPB Peripheral) Color Management Driver TcnPeripheral64.sys ve
CVE-2017-7293 HIGH POC
7.8 Apr 26

The Dolby DAX2 and DAX3 API services are vulnerable to a privilege escalation vulnerability that allows a normal user to
CVE-2015-6971 HIGH POC
7.8 Oct 03

Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0013 allows local users to submit commands to the
CVE-2015-8110 HIGH POC
7.8 Apr 24

Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0019 allows local users to gain privileges by nav
CVE-2021-3633 HIGH POC
7.8 Aug 17

A DLL preloading vulnerability was reported in Lenovo Driver Management prior to version 2.9.0719.1104 that could allow

CVE-2022-0354 HIGH POC
7.3 Apr 22

A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the ab
CVE-2015-3214 MEDIUM POC
6.9 Aug 31

The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-53348 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy