CVE-2026-53298: Linux Kernel Airoha Driver NULL Pointer Dereference DoS

Technical summary

CVE-2026-53298 is a NULL pointer dereference vulnerability in the Linux kernel's Airoha QDMA (Queue DMA) driver, specifically in the airoha_qdma_init_rx_queue() function. The vulnerability stems from premature initialization of the ndesc field, which is used as a flag to indicate whether a queue has been fully initialized. If memory allocation for queue entries or DMA descriptors fails partway through initialization, the cleanup path (airoha_qdma_cleanup()) calls netif_napi_del() on uninitialized NAPI structures because it relies on ndesc being set to determine if cleanup is needed. The fix involves deferring ndesc initialization until after all allocations succeed, and reordering page_pool allocation to occur after descriptor list allocation to prevent memory leaks. The vulnerability is classified as CWE-476 (NULL Pointer Dereference).

Business impact

This vulnerability allows a local attacker with user-level privileges to trigger a denial-of-service condition by crashing the kernel through manipulation of the Airoha network driver initialization. Systems using Airoha-based network interfaces could experience unexpected downtime. The impact is limited to availability; no data confidentiality or integrity compromise is possible. Organizations running affected Linux kernel versions on hardware with Airoha network controllers should prioritize patching to maintain system stability.

Affected systems

The vulnerability affects the Linux kernel across all versions containing the affected Airoha QDMA driver code. It impacts systems using Airoha network interface hardware. Check your kernel version and hardware vendor to determine if your system uses Airoha-based network controllers. The fix has been applied to the upstream Linux kernel; downstream distributions will incorporate the patch in their respective maintenance releases.

Exploitability

Exploitation requires local access to the affected system with unprivileged user privileges. The attack vector is local with low complexity—an attacker need only trigger the network queue initialization failure path, which could potentially be done through network driver reloading or manipulation of driver initialization parameters. However, the vulnerability is not remotely exploitable and does not provide privilege escalation. The CVSS 3.1 score of 5.5 (MEDIUM) reflects local-only access requirements and impact limited to availability.

Remediation

Apply the Linux kernel patch that moves ndesc initialization to the end of the airoha_qdma_init_tx routine and reorders page_pool allocation after descriptor list allocation. Verify the specific kernel version containing this patch against your distribution's security advisories. Most major Linux distributions will backport this fix to their maintained kernel branches. System administrators should update their kernel packages through their distribution's package management system once patches are available.

Patch guidance

Monitor your Linux distribution's kernel security advisories for updates incorporating this fix. Verify the patch is present by checking kernel release notes or git commit history for the Airoha driver. Test patched kernels in a non-production environment before deploying to production systems to ensure compatibility with your specific hardware and workloads. Coordinate kernel updates with maintenance windows to minimize service disruption.

Detection guidance

Monitor system logs for kernel panic or oops messages referencing the airoha driver, particularly those involving netif_napi_del() or NULL pointer dereferences in QDMA initialization code. If you control driver loading, observe for failures during network interface initialization. Kernel debugging tools and crash analysis can reveal whether a system has been affected. Proactive patching remains the most reliable mitigation.

Why prioritize this

While this is a MEDIUM-severity vulnerability limited to local denial-of-service, it merits timely patching because: (1) it affects system stability on hardware with Airoha network interfaces, (2) any user-level process can trigger it, and (3) unplanned kernel crashes disrupt operations and complicate incident response. Prioritize patches for production systems using Airoha hardware; systems without Airoha controllers are not affected.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects a local-only attack vector (AV:L), low complexity (AC:L), no special privileges required (PR:L), no user interaction (UI:N), unchanged scope (S:U), and high impact to availability (A:H) with no confidentiality or integrity impact. The score appropriately captures that while the vulnerability is easily triggered by local users, it does not enable remote attacks or privilege escalation, and impact is limited to system availability.

Frequently asked questions