CVE-2026-53339: Linux i2c-qcom-cci NULL Pointer Dereference on Driver Removal

Technical summary

CVE-2026-53339 is a NULL pointer dereference in the cci_remove() function of the i2c-qcom-cci Linux kernel driver. The vulnerability stems from incomplete initialization handling: the driver iterates through two I2C masters during removal, calling cci_halt() on each, but completion objects are only initialized for enabled masters. When cci_halt() attempts to wait_for_completion_timeout() on an uninitialized completion structure, a NULL pointer dereference occurs. The flaw is exposed during module unload (rmmod) or platform device removal. CWE-476 (Null Pointer Dereference) is the underlying weakness.

Business impact

Affected systems experience kernel crashes or hangs during driver shutdown scenarios, including module unload, device hot-removal, or system reboot sequences. For production environments relying on Qualcomm camera hardware on ARM64 platforms, this can disrupt device functionality and complicate maintenance windows. While not a data breach or privilege escalation vector, the denial-of-service impact may degrade availability of devices dependent on the CCI controller.

Affected systems

The Linux kernel's i2c-qcom-cci driver is affected. This driver manages the Qualcomm Camera Control Interface I2C subsystem, found primarily in ARM64 systems using Qualcomm SoCs with camera control hardware. Affected systems typically include mobile devices, embedded systems, and specialized hardware using modern Qualcomm platforms that initialize the CCI controller. Check your kernel configuration for CONFIG_I2C_QCOM_CCI to determine if your system includes this driver.

Exploitability

Exploitation requires local access and the ability to unload kernel modules or trigger device removal. No remote exploitation path exists. The vulnerability is triggered passively during normal administrative operations (driver unload, device unbind) rather than through crafted input or active exploitation. A local user with permissions to unload modules could trivially trigger the crash, making the barrier to triggering the defect very low once system access is obtained.

Remediation

Update the Linux kernel to a patched version that includes the fix to cci_remove(). The fix ensures that completion structures are only waited on if they were initialized during probe, preventing the NULL pointer dereference. Verify the specific patch or kernel version from your vendor's advisory. Alternatively, if CCI controller support is not required, disable CONFIG_I2C_QCOM_CCI at kernel build time.

Patch guidance

Consult your Linux distribution or Qualcomm platform vendor for patched kernel versions. The upstream Linux kernel fix addresses the initialization logic to track which I2C masters are enabled and avoids calling wait_for_completion_timeout() on uninitialized completions. Patch releases will vary by distribution (Ubuntu, Fedora, RHEL, Android, etc.); verify against your vendor's security advisory. Test the patched kernel in a non-production environment before wide deployment to ensure camera hardware continues functioning correctly.

Detection guidance

Monitor kernel logs for NULL pointer dereference messages at address 0x0 occurring in wait_for_completion_timeout() or within the i2c_qcom_cci module stack trace. Automated log analysis tools can flag stack traces mentioning 'cci_remove' paired with memory access violations. Additionally, track module unload events and correlate with system crashes or reboots. Userspace tools like systemd-journal or auditd can capture device-remove events preceding the failure.

Why prioritize this

Although the CVSS score is 5.5 (MEDIUM), this should be prioritized for devices where the CCI controller is essential for operation and frequent driver reloading occurs, or where systems require reliable shutdown behavior. Non-critical systems can defer patching, but production deployments using Qualcomm camera hardware should plan timely updates. The vulnerability is easy to trigger but does not enable privilege escalation or data theft, limiting its severity compared to remote or elevation-of-privilege flaws.

Risk score, explained

The CVSS v3.1 score of 5.5 reflects: Local Attack Vector (AV:L) – requires system access; Low Attack Complexity (AC:L) – standard driver operations trigger it; Low Privileges (PR:L) – ordinary user can unload modules; No User Interaction (UI:N); Confidentiality and Integrity unaffected (C:N, I:N); Availability High impact (A:H) – kernel crash. The score appropriately categorizes a local denial-of-service condition without security boundary violations.

Frequently asked questions