PT-2026-51936 · Linux · Linux

Publicado 2026-06-24 · Atualizado 2026-06-24 · CVE-2026-53042

NVD

In the Linux kernel, the following vulnerability has been resolved:

fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal

CXL is linked before fwctl in drivers/Makefile. Both use module init, so cxl pci driver init()runs first. Whencxl pci probe()callsfwctl register()and thendevice add(), fwctl class is not yet registered because fwctl init() hasn't run, causing class to subsys()` to return NULL and skip knode class initialization.

On device removal, class to subsys() returns non-NULL, and device del() calls klist del() on the uninitialized knode, triggering a NULL pointer dereference.

Identificadores relacionados

CVE-2026-53042

Produtos afetados

Linux

Referências · 4

• https://git.kernel.org/stable/c/a28f56988c8e5bb9375806a5cfb0bf54d662ae3f · Nota
• https://git.kernel.org/stable/c/a55f80233f384dc89ef3425b2e1dd0e6d44bcf29 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-53042 · Nota de Segurança
• https://git.kernel.org/stable/c/1075f2f590fdac147f8b8010c35b606564b5c7d7 · Nota