The Linux kernel vulnerability CVE-2026-53152 involves the dw_mmc-rockchip driver for very old Rockchip SoCs (rk2928, rk3066, rk3188) that do not support UHS speeds and historically did not have private driver data or a parse_dt callback. A kernel commit (ff6f0286c896) introduced a requirement for private data to check phase configuration, which leads to NULL-pointer dereferences on these old controllers when the driver attempts to access non-existent private data. This causes kernel crashes (denial of service) on affected hardware.

The vulnerability causes NULL-pointer dereferences resulting in denial of service (kernel crashes) on affected Rockchip SoCs when using the dw_mmc-rockchip driver. There is no impact on confidentiality or integrity. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability arises from missing private data structures for old controllers; the referenced kernel commit suggests adding private data for these old types to prevent NULL-pointer dereferences. Until an official fix is confirmed, affected users should monitor vendor advisories for patches.