CVE-2026-53042
Severity CVSS v4.0:
Pending analysis
Type:
CWE-824
Access of Uninitialized Pointer
Publication date:
24/06/2026
Last modified:
14/07/2026
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal<br />
<br />
CXL is linked before fwctl in drivers/Makefile. Both use `module_init, so<br />
`cxl_pci_driver_init()` runs first. When `cxl_pci_probe()` calls<br />
`fwctl_register()` and then `device_add()`, fwctl_class is not yet<br />
registered because fwctl_init() hasn&#39;t run, causing `class_to_subsys()` to<br />
return NULL and skip knode_class initialization.<br />
<br />
On device removal, `class_to_subsys()` returns non-NULL, and<br />
`device_del()` calls `klist_del()` on the uninitialized knode, triggering<br />
a NULL pointer dereference.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.15 (including) | 6.18.33 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.19 (including) | 7.0.10 (excluding) |
To consult the complete list of CPE names with products and versions, see this page