CVE-2026-53338
Severity CVSS v4.0:
Pending analysis
Type:
CWE-476
NULL Pointer Dereference
Publication date:
01/07/2026
Last modified:
23/07/2026
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
net: airoha: Add NULL check for of_reserved_mem_lookup() in airoha_qdma_init_hfwd_queues()<br />
<br />
of_reserved_mem_lookup() may return NULL if the reserved memory region<br />
referenced by the "memory-region" phandle is not found in the reserved<br />
memory table (e.g. due to a misconfigured DTS or a removed<br />
memory-region node). The current code dereferences the returned<br />
pointer without checking for NULL, leading to a kernel NULL pointer<br />
dereference at the following lines:<br />
<br />
dma_addr = rmem->base; // line 1156<br />
num_desc = div_u64(rmem->size, buf_size); // line 1160<br />
<br />
Add a NULL check after of_reserved_mem_lookup() and return -ENODEV if<br />
the lookup fails, which is consistent with the existing error handling<br />
for of_parse_phandle() failure in the same code block.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.16 (including) | 6.18.36 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.19 (including) | 7.0.13 (excluding) |
| cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:7.1:rc7:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page



