In the Linux kernel, the following vulnerability has been resolved: mmc: dw_mmc-rockchip: Add missing private data for very old controllers The… (CVE-2026-53152)
In the Linux kernel, the following vulnerability has been resolved: mmc: dw_mmc-rockchip: Add missing private data for very old controllers The really old controllers (rk2928, rk3066, rk3188) do not support UHS speeds at all, and thus never handled phase data. For that reason it never had a parse_dt callback and no driver private data at all. Commit ff6f0286c896 ("mmc: dw_mmc-rockchip: Add memory clock auto-gating support") makes the private data sort of mandatory, because the init function checks whether phases are configured internally or through the clock controller. This results in the old SoCs then experiencing NULL-pointer dereferences when they try to access that private-data struct. While we could have if (priv) conditionals in all places, it's way less cluttery to just give the old types their private-data struct.
AI Analysis
Technical Summary
The Linux kernel vulnerability CVE-2026-53152 involves the dw_mmc-rockchip driver for very old Rockchip SoCs (rk2928, rk3066, rk3188) that do not support UHS speeds and historically did not have private driver data or a parse_dt callback. A kernel commit (ff6f0286c896) introduced a requirement for private data to check phase configuration, which leads to NULL-pointer dereferences on these old controllers when the driver attempts to access non-existent private data. This causes kernel crashes (denial of service) on affected hardware.
Potential Impact
The vulnerability causes NULL-pointer dereferences resulting in denial of service (kernel crashes) on affected Rockchip SoCs when using the dw_mmc-rockchip driver. There is no impact on confidentiality or integrity. No known exploits are reported in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability arises from missing private data structures for old controllers; the referenced kernel commit suggests adding private data for these old types to prevent NULL-pointer dereferences. Until an official fix is confirmed, affected users should monitor vendor advisories for patches.
In the Linux kernel, the following vulnerability has been resolved: mmc: dw_mmc-rockchip: Add missing private data for very old controllers The… (CVE-2026-53152)
Description
In the Linux kernel, the following vulnerability has been resolved: mmc: dw_mmc-rockchip: Add missing private data for very old controllers The really old controllers (rk2928, rk3066, rk3188) do not support UHS speeds at all, and thus never handled phase data. For that reason it never had a parse_dt callback and no driver private data at all. Commit ff6f0286c896 ("mmc: dw_mmc-rockchip: Add memory clock auto-gating support") makes the private data sort of mandatory, because the init function checks whether phases are configured internally or through the clock controller. This results in the old SoCs then experiencing NULL-pointer dereferences when they try to access that private-data struct. While we could have if (priv) conditionals in all places, it's way less cluttery to just give the old types their private-data struct.
CVSS v3.1
Score 5.5medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel vulnerability CVE-2026-53152 involves the dw_mmc-rockchip driver for very old Rockchip SoCs (rk2928, rk3066, rk3188) that do not support UHS speeds and historically did not have private driver data or a parse_dt callback. A kernel commit (ff6f0286c896) introduced a requirement for private data to check phase configuration, which leads to NULL-pointer dereferences on these old controllers when the driver attempts to access non-existent private data. This causes kernel crashes (denial of service) on affected hardware.
Potential Impact
The vulnerability causes NULL-pointer dereferences resulting in denial of service (kernel crashes) on affected Rockchip SoCs when using the dw_mmc-rockchip driver. There is no impact on confidentiality or integrity. No known exploits are reported in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability arises from missing private data structures for old controllers; the referenced kernel commit suggests adding private data for these old types to prevent NULL-pointer dereferences. Until an official fix is confirmed, affected users should monitor vendor advisories for patches.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-38rg-2rjc-3rmj
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-53152"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a4c344d27e9c797195fc312
Added to database: 07/06/2026, 23:03:41 UTC
Last enriched: 07/06/2026, 23:38:03 UTC
Last updated: 07/31/2026, 19:24:47 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.