CVE-2026-53152: Linux Rockchip eMMC Driver NULL Pointer Dereference (RK2928/RK3066/RK3188)

Technical summary

CVE-2026-53152 is a CWE-476 NULL-pointer dereference in the dw_mmc-rockchip driver. The legacy Rockchip SoCs (rk2928, rk3066, rk3188) were designed before UHS phase handling was implemented, and therefore had no parse_dt callback or driver private data allocation. Commit ff6f0286c896 introduced mandatory phase configuration checks that reference the private-data struct without null validation. When these old controllers attempt initialization, they dereference a NULL pointer, triggering a kernel panic. The issue becomes exploitable as a local denial-of-service vector on systems running affected kernel versions with these legacy SoCs and a local unprivileged user account.

Business impact

Organizations using RK2928-, RK3066-, or RK3188-based embedded systems running vulnerable Linux kernels face potential service interruption through local denial of service. While the attack surface is limited to systems with local user access, affected devices—commonly found in industrial IoT, set-top boxes, and legacy Android-based products—could be remotely compromised if combined with privilege escalation vulnerabilities. Persistent availability issues from kernel panics increase operational overhead and pose security posture risks in compliance-sensitive environments.

Affected systems

The vulnerability affects Linux kernel versions containing commit ff6f0286c896 (memory clock auto-gating support) without the corresponding NULL-pointer protection patch. Specifically targeted are systems with Rockchip RK2928, RK3066, or RK3188 SoCs. Distributions shipping these kernel versions with affected Rockchip platforms—including older Android devices, set-top boxes, and specialized embedded appliances—are at risk. Check your kernel release notes and device specifications to confirm both the kernel version and whether your hardware uses one of these legacy Rockchip variants.

Exploitability

Exploitation requires local access (AV:L) with standard user privileges (PR:L) and no user interaction (UI:N). An unprivileged local user can trigger the NULL-pointer dereference through normal device initialization or driver reload operations, causing an immediate kernel panic. The attack is deterministic and does not require exploitation of other vulnerabilities. However, the impact is confined to denial of service; no data exfiltration or privilege escalation occurs directly from this flaw.

Remediation

Apply kernel patches that restore NULL-pointer safety to the dw_mmc-rockchip driver by either allocating private-data structures for legacy controllers or adding defensive null-checks before dereferencing the priv struct. Vendors and distributions should backport the fix to supported kernel branches. For immediate mitigation on systems that cannot be patched, disable local user shell access where possible, though this is often impractical for production devices. Verify the fix is included in your next kernel update by checking the commit log against your vendor's advisory.

Patch guidance

Update to a patched Linux kernel version that includes fixes for dw_mmc-rockchip NULL-pointer handling. Contact your Linux distribution, device manufacturer, or Rockchip vendor for specific patch version numbers and release timelines. Kernel maintainers have likely issued stable-kernel backports; check [email protected] or your distribution's security advisories for exact version numbers. Test patches in a non-production environment first to ensure compatibility with your specific embedded platform and driver configuration.

Detection guidance

Monitor kernel logs and system event logs for dw_mmc-rockchip driver initialization failures and NULL-pointer dereference oops messages (typically containing 'NULL pointer dereference' and referencing the Rockchip eMMC driver). Set up alerts for unexpected kernel panics or device reboots on RK2928-, RK3066-, or RK3188-based systems. Use SELinux/AppArmor audit logs to correlate local user activity with fault events. For forensic analysis, enable kernel debugging symbols and preserve kernel crash dumps (kdump) to confirm the vulnerability's presence.

Why prioritize this

Although scored MEDIUM (CVSS 5.5), this vulnerability warrants prompt attention due to its straightforward exploitability by any local user and the critical consequence of service denial on embedded systems that often lack redundancy. Legacy Rockchip platforms are found in long-lived IoT and set-top-box deployments where unplanned restarts create operational friction. Organizations relying on these devices should prioritize patching to maintain availability SLAs. The low bar to exploitation and deterministic nature elevate business risk despite the narrower affected-system footprint.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects the availability impact (AH) from kernel panic offset against the requirement for local access (AV:L) and unprivileged credentials (PR:L). The score appropriately captures denial of service as the sole impact, with no confidentiality or integrity concerns. For organizations operating legacy Rockchip devices with regular local user access, the practical risk is higher due to deterministic exploitation. Risk context should include your asset inventory: devices without this SoC variant should see negligible risk.

Frequently asked questions