A vulnerability in the Linux kernel's airoha network driver can cause a NULL pointer dereference during cleanup if queue entry or DMA descriptor… (CVE-2026-53298)
A vulnerability in the Linux kernel's airoha network driver can cause a NULL pointer dereference during cleanup if queue entry or DMA descriptor list allocation fails. This occurs because the ndesc variable is initialized too early, leading to improper cleanup attempts on uninitialized RX NAPI queues. The issue has been fixed by moving the ndesc initialization to the end of the initialization routine and adjusting memory allocation order to prevent leaks.
AI Analysis
Technical Summary
The Linux kernel airoha driver contained a vulnerability where failure in queue entry or DMA descriptor list allocation within the airoha_qdma_init_rx_queue() function could lead to a NULL pointer dereference in airoha_qdma_cleanup(). This happens because netif_napi_del() is called on RX queue NAPIs that were never properly added due to early ndesc initialization. The fix involves moving ndesc initialization to the end of the initialization routine and reallocating page_pool after descriptor list allocation to avoid memory leaks if allocation fails.
Potential Impact
This vulnerability can cause a denial of service (system crash) due to a NULL pointer dereference in the network driver when allocation failures occur during RX queue initialization. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The issue is fixed by adjusting initialization order in the driver code to prevent NULL pointer dereference and memory leaks.
A vulnerability in the Linux kernel's airoha network driver can cause a NULL pointer dereference during cleanup if queue entry or DMA descriptor… (CVE-2026-53298)
Description
A vulnerability in the Linux kernel's airoha network driver can cause a NULL pointer dereference during cleanup if queue entry or DMA descriptor list allocation fails. This occurs because the ndesc variable is initialized too early, leading to improper cleanup attempts on uninitialized RX NAPI queues. The issue has been fixed by moving the ndesc initialization to the end of the initialization routine and adjusting memory allocation order to prevent leaks.
CVSS v3.1
Score 5.5medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel airoha driver contained a vulnerability where failure in queue entry or DMA descriptor list allocation within the airoha_qdma_init_rx_queue() function could lead to a NULL pointer dereference in airoha_qdma_cleanup(). This happens because netif_napi_del() is called on RX queue NAPIs that were never properly added due to early ndesc initialization. The fix involves moving ndesc initialization to the end of the initialization routine and reallocating page_pool after descriptor list allocation to avoid memory leaks if allocation fails.
Potential Impact
This vulnerability can cause a denial of service (system crash) due to a NULL pointer dereference in the network driver when allocation failures occur during RX queue initialization. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The issue is fixed by adjusting initialization order in the driver code to prevent NULL pointer dereference and memory leaks.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-qvrw-vpg6-fx6m
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-53298"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a4e4ed8c9d9e3dbe32883bf
Added to database: 07/08/2026, 13:21:28 UTC
Last enriched: 07/08/2026, 13:30:46 UTC
Last updated: 07/31/2026, 19:24:47 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.