NULL Pointer Dereference in Linux Kernel fwctl Module

Publication date: 2026-06-24

Last updated on: 2026-07-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal CXL is linked before fwctl in drivers/Makefile. Both use `module_init, so `cxl_pci_driver_init()` runs first. When `cxl_pci_probe()` calls `fwctl_register()` and then `device_add()`, fwctl_class is not yet registered because fwctl_init() hasn't run, causing `class_to_subsys()` to return NULL and skip knode_class initialization. On device removal, `class_to_subsys()` returns non-NULL, and `device_del()` calls `klist_del()` on the uninitialized knode, triggering a NULL pointer dereference.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-07-14

Generated

2026-07-15

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-14

NVD

CVE-2026-53042

EUVD

EUVD-2026-38910

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.19 (inc) to 7.0.10 (exc)
linux	linux_kernel	From 6.15 (inc) to 6.18.33 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-824	The product accesses or uses a pointer that has not been initialized.

Attack-Flow Graph

Executive Summary

This vulnerability occurs in the Linux kernel related to the initialization order of the fwctl class and the CXL driver. Because CXL is initialized before fwctl, when the CXL probe function calls fwctl_register and device_add, the fwctl class is not yet registered. This causes a function called class_to_subsys to return NULL, skipping some initialization steps. Later, when a device is removed, class_to_subsys returns a non-NULL value, but the device removal process calls a function on an uninitialized data structure, leading to a NULL pointer dereference.

Impact Analysis

This vulnerability can cause a NULL pointer dereference during device removal, which typically results in a kernel crash or system instability. Such crashes can lead to denial of service, affecting system availability and potentially causing data loss or interruption of critical services.

Hi! I’m here to help you understand CVE-2026-53042. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70