CVE-2026-53332: Linux Kernel SLIMbus NGD Driver Race Condition Causes Boot Failures

Technical summary

CVE-2026-53332 is a use-of-uninitialized-data vulnerability in the slimbus qcom-ngd-ctrl driver. The driver's probe routine registers callbacks (SSR and PDR notifications) and enables interrupts before the NGD device structure is fully initialized. If the remoteproc firmware starts, the PDR subsystem notifies the driver, or hardware generates an interrupt during this window, callbacks like qcom_slim_ngd_ssr_pdr_notify() attempt to queue work on NULL pointers, specifically ngd_up_work. The fix reorders initialization so that interrupt and notification registration occurs after NGD device registration, ensuring data structures are valid when callbacks execute.

Business impact

Systems relying on Qualcomm modem or audio subsystems that depend on SLIMbus—particularly Snapdragon-based smartphones and embedded platforms—may experience boot failures, unexpected reboots, or denial of service. The impact is most pronounced in scenarios where firmware boot races with driver initialization, a common occurrence during system startup or modem recovery cycles. Device manufacturers and service providers supporting affected hardware should prioritize testing and deployment of patched kernels to prevent support escalations and field failures.

Affected systems

The vulnerability affects Linux kernels with the Qualcomm NGD controller driver built-in or as a module. This primarily impacts Snapdragon-based devices including smartphones, tablets, and IoT platforms that use Qualcomm modems or audio DSPs communicating over SLIMbus. Desktop and server Linux systems using generic Qualcomm hardware accelerators or modems are at lower risk. The vulnerability exists in multiple kernel versions until the fix is backported.

Exploitability

This is not a privilege escalation or remote code execution vulnerability. Exploitation requires local access and a specific race condition timing. However, the condition naturally occurs during normal system boot and modem recovery, making it reliably triggerable without active exploitation. A local attacker with the ability to trigger remoteproc firmware resets could intentionally reproduce the crash, resulting in denial of service. The CVSS score of 5.5 (Medium) reflects the availability impact and local-access requirement.

Remediation

Apply kernel patches that move SSR (Subsystem Restart) and PDR (Power Domain Restart) callback registration, as well as interrupt enablement, to occur after NGD device registration completes. This reordering eliminates the initialization race window. End users should update to patched kernel versions released by their distribution or device manufacturer. For device manufacturers, backporting the fix to supported kernel branches is essential for field updates.

Patch guidance

Verify availability of kernel updates for your specific Linux distribution and Qualcomm-based hardware platform. Check Linux kernel stable branches and distribution security advisories for CVE-2026-53332 patches. If using custom kernels, apply the upstream fix from the Linux kernel repository once available. The patch is expected to be integrated into mainline and stable kernel trees; verify against the official Linux Kernel Archives (kernel.org) for exact version availability.

Detection guidance

Monitor system logs for kernel warnings or errors related to workqueue operations on NULL pointers, particularly 'WARNING: kernel/workqueue.c' messages during boot or modem startup. Look for 'qcom_slim_ngd_ssr_pdr_notify' in stack traces. Repeated boot failures or spontaneous reboots on Qualcomm-based systems without obvious hardware cause may indicate this vulnerability. Automated log analysis tools can flag these patterns for follow-up. No userspace exploit detection is feasible; mitigation relies on patching.

Why prioritize this

This vulnerability should be addressed promptly for any organization operating Qualcomm-based mobile devices or embedded systems in production. The natural trigger condition (firmware boot race) means affected systems are likely encountering the issue spontaneously, causing availability disruptions. Although the severity is Medium, the likelihood of triggering the condition during normal operation—not requiring active exploitation—elevates practical risk. Prioritize patching for high-touch device fleets first to reduce support burden.

Risk score, explained

CVSS 5.5 reflects a Medium severity because the vulnerability causes only denial of service (system crash/reboot), with no confidentiality or integrity impact. The attack vector is local and requires privilege level L, limiting exposure. However, the score does not capture the ease of natural triggering during routine operations, which is a practical risk multiplier. Organizations should treat this as higher urgency than the numeric score alone suggests due to its operational impact on device availability.

Frequently asked questions