PT-2026-51936 · Linux · Linux
Published
2026-06-24
·
Updated
2026-06-24
·
CVE-2026-53042
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal
CXL is linked before fwctl in drivers/Makefile. Both use
module init, so cxl pci driver init()runs first. Whencxl pci probe()callsfwctl register()and thendevice add(), fwctl class is not yet registered because fwctl init() hasn't run, causing class to subsys()` to
return NULL and skip knode class initialization.On device removal,
class to subsys() returns non-NULL, and
device del() calls klist del() on the uninitialized knode, triggering
a NULL pointer dereference. Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux