Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-53331— slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于qcom-ngd-ctrl中tx_lock和ctrl->lock的获取顺序不一致，可能导致死锁。

AI Predicted 3.3 Difficulty: Hard EPSS 0.13% · P2

Affected Version Matrix 16

VendorProduct Version RangeStatus
Linux Linux a899d324863a3d15ce0eea513884e1b73a758c58< 3d1561537237c6cc1db76155183d8bbdac2339f0 affected
a899d324863a3d15ce0eea513884e1b73a758c58< dc4d5c57e012c2c669793deb1515a57bbc6bf5dd affected
a899d324863a3d15ce0eea513884e1b73a758c58< d54a221b0f3cd9e1f03f18104be34e02a8258fae affected
a899d324863a3d15ce0eea513884e1b73a758c58< aad4337a21b9ad3ae8d668fa8678d05e26ecbaa8 affected
a899d324863a3d15ce0eea513884e1b73a758c58< 9f0d45d509b434c54da10e01f4ef8086e4583401 affected
a899d324863a3d15ce0eea513884e1b73a758c58< 9708eb50fd7343145b422be852f890212155d845 affected
a899d324863a3d15ce0eea513884e1b73a758c58< 55f2ea9ff83cc27a85526b14bc9b32f96a08d6ec affected
5.11 affected
… +8 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-53331

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock During the SSR/PDR down notification the tx_lock is taken with the intent to provide synchronization with active DMA transfers. But during this period qcom_slim_ngd_down() is invoked, which ends up in slim_report_absent(), which takes the slim_controller lock. In multiple other codepaths these two locks are taken in the opposite order (i.e. slim_controller then tx_lock). The result is a lockdep splat, and a possible deadlock: rprocctl/449 is trying to acquire lock: ffff00009793e620 (&ctrl->lock){+.+.}-{4:4}, at: slim_report_absent (drivers/slimbus/core.c:322) slimbus but task is already holding lock: ffff00009793fb50 (&ctrl->tx_lock){+.+.}-{4:4}, at: qcom_slim_ngd_ssr_pdr_notify (drivers/slimbus/qcom-ngd-ctrl.c:1475) slim_qcom_ngd_ctrl which lock already depends on the new lock. Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&ctrl->tx_lock); lock(&ctrl->lock); lock(&ctrl->tx_lock); lock(&ctrl->lock); The assumption is that the comment refers to the desire to not call qcom_slim_ngd_exit_dma() while we have an ongoing DMA TX transaction. But any such transaction is initiated and completed within a single qcom_slim_ngd_xfer_msg(). Prior to calling qcom_slim_ngd_exit_dma() the slim_controller is torn down, all child devices are notified that the slimbus is gone and the child devices are removed. Stop taking the tx_lock in qcom_slim_ngd_ssr_pdr_notify() to avoid the deadlock.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于qcom-ngd-ctrl中tx_lock和ctrl->lock的获取顺序不一致，可能导致死锁。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux a899d324863a3d15ce0eea513884e1b73a758c58 ~ 3d1561537237c6cc1db76155183d8bbdac2339f0 -
Linux Linux 5.11 -

II. Public POCs for CVE-2026-53331

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-53331

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-53331 (7)

Same Patch Batch · Linux · 2026-07-01 · 31 CVEs total

CVE-2026-53355 9.8 CRITICAL net: rds: clear i_sends on setup unwind
CVE-2026-53354 8.8 HIGH arm64: errata: Mitigate TLBI errata on various Arm CPUs
CVE-2026-53356 7.8 HIGH drm/i915/gem: Fix phys BO pread/pwrite with offset
CVE-2026-53341 7.8 HIGH fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()
CVE-2026-53329 7.0 HIGH drm/amd/display: Use krealloc_array() in dal_vector_reserve()
CVE-2026-53342 arm64: mm: call pagetable dtor when freeing hot-removed page tables
CVE-2026-53353 hsr: Remove WARN_ONCE() in hsr_addr_is_self().
CVE-2026-53352 signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()
CVE-2026-53351 riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI
CVE-2026-53350 ASoC: wm_adsp: Fix NULL dereference when removing firmware controls
CVE-2026-53348 ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions
CVE-2026-53349 netfilter: nf_conntrack: destroy stale expectfn expectations on unregister
CVE-2026-53346 rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES
CVE-2026-53347 drm/virtio: Fix driver removal with disabled KMS
CVE-2026-53344 pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init
CVE-2026-53345 KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying
CVE-2026-53343 ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow
CVE-2026-53327 debugobjects: Do not fill_pool() if pi_blocked_on
CVE-2026-53340 i2c: imx: fix clock and pinctrl state inconsistency in runtime PM
CVE-2026-53339 i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()

Showing top 20 of 31 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-53331

No comments yet

Leave a comment