Skip to main content

Linux Kernel CVE-2026-53350

| EUVDEUVD-2026-40984 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-07-01 Linux GHSA-q7rw-6rp9-vhj5
Null Pointer Dereference Linux Denial Of Service Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local attack vector and low privileges required to trigger module removal; only availability impact via kernel panic, no confidentiality or integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 22, 2026 - 20:45 vuln.today
CVSS changed
Jul 22, 2026 - 19:22 NVD
5.5 (MEDIUM)
Patch available
Jul 01, 2026 - 15:16 EUVD
CVE Published
Jul 01, 2026 - 13:32 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 01, 2026 - 13:32 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

ASoC: wm_adsp: Fix NULL dereference when removing firmware controls

In wm_adsp_control_remove() check that the priv pointer is not NULL before attempting to cleanup what it points to.

When cs_dsp creates a control it calls wm_adsp_control_add_cb() so that wm_adsp can create its own private control data. There are two cases where private data is not created:

  1. The control is a SYSTEM control, so an ALSA control is not created.
  2. The codec driver has registered a control_add() callback that

hides the control, so wm_adsp_control_add() is not called.

When cs_dsp_remove destroys its control list it calls wm_adsp_control_remove() for each control. But wm_adsp_control_remove() was attempting to cleanup the private data pointed to by cs_ctl->priv without checking the pointer for NULL.

AnalysisAI

NULL pointer dereference in the Linux kernel's ASoC wm_adsp driver crashes the kernel when firmware controls are removed without a prior NULL check on private control data. Systems running affected kernel versions (5.16 through multiple stable branches) with Wolfson/Cirrus Logic ADSP hardware are exposed to local denial-of-service via kernel panic. No active exploitation has been identified, EPSS sits at 0.16% (6th percentile), and patches have been backported to all active stable branches.

Technical ContextAI

The vulnerability resides in the ASoC (Audio System on Chip) subsystem's wm_adsp driver, which provides Linux kernel support for Wolfson/Cirrus Logic DSP chips (CWE-476: NULL Pointer Dereference). The cs_dsp library manages DSP control objects and notifies wm_adsp via callbacks when controls are added or removed. wm_adsp_control_add_cb() allocates private data (cs_ctl->priv) for controls that map to ALSA controls, but two code paths skip this allocation: SYSTEM controls (which have no ALSA representation) and controls suppressed by a codec driver's control_add() callback. When cs_dsp_remove() tears down its control list, it invokes wm_adsp_control_remove() for every control - including those with a NULL priv pointer - and the missing NULL guard causes a kernel NULL dereference. Affected CPE: cpe:2.3:a:linux:linux. The flaw was introduced at commit 0700bc2fb94c28459f57a10d2ee2c7ef4cb70862, placed in the 5.16 lineage.

RemediationAI

The primary fix is to upgrade to a patched kernel release: 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13, or 7.1, depending on the branch in use. Patch commits are available at https://git.kernel.org/stable/c/5ee9bbe2af2f373e08d3017f9aef2f2eaf29fbc3 (6.1), https://git.kernel.org/stable/c/10def23b67b42679d5b1a356e1a6f3498bd188c3 (6.6), https://git.kernel.org/stable/c/2f1be283aa777d655525d000d16474b7e7d015ea (6.12), and the remaining backports at the referenced stable-tree URLs. For systems where a kernel update is not immediately feasible, blacklisting or unloading the snd-soc-wm-adsp module (modprobe -r snd_soc_wm_adsp) prevents the vulnerable code path from executing, at the cost of disabling DSP-backed audio functionality on the affected hardware. Since exploitation requires local low-privilege access, enforcing strong local user access controls and restricting module unload permissions (via CAP_SYS_MODULE controls) provides additional compensating defense.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Null Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed

Share

CVE-2026-53350 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy