CVE-2026-53042 Details
Description
In the Linux kernel, the following vulnerability has been resolved: fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal CXL is linked before fwctl in drivers/Makefile. Both use `module_init, so `cxl_pci_driver_init()` runs first. When `cxl_pci_probe()` calls `fwctl_register()` and then `device_add()`, fwctl_class is not yet registered because fwctl_init() hasn't run, causing `class_to_subsys()` to return NULL and skip knode_class initialization. On device removal, `class_to_subsys()` returns non-NULL, and `device_del()` calls `klist_del()` on the uninitialized knode, triggering a NULL pointer dereference.
A vulnerability in the fwctl component of the Linux kernel can lead to a NULL pointer dereference during device removal. This issue arises because the fwctl class is not properly initialized before it is used, due to a misordering in the initialization process. When the CXL driver probes and registers with fwctl, the fwctl class has not yet been initialized, causing subsequent operations to fail. As a result, when the device is removed, the system attempts to access an uninitialized resource, leading to a crash.
The vulnerability has been addressed by changing the fwctl initialization to use 'subsys_initcall' instead of 'module_init', ensuring that it is properly registered before being used by other components.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/1075f2f590fdac147f8b8010c35b606564b5c7d7 | kernel.org | Patch |
| https://git.kernel.org/stable/c/a28f56988c8e5bb9375806a5cfb0bf54d662ae3f | kernel.org | Patch |
| https://git.kernel.org/stable/c/a55f80233f384dc89ef3425b2e1dd0e6d44bcf29 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-824 | Access of Uninitialized Pointer | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.15, < 6.18.33 >= 6.19, < 7.0.10 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | Initial Analysis | [email protected] |
| Jun 24, 2026 | New CVE Received | kernel.org |