CVE-2026-53338— net: airoha: Add NULL check for of_reserved_mem_lookup() in airoha_qdma_init_hfwd_queues()
Possible ATT&CK Techniques 1AI
T1499 · Endpoint Denial of ServiceGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-53338
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
net: airoha: Add NULL check for of_reserved_mem_lookup() in airoha_qdma_init_hfwd_queues()
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net: airoha: Add NULL check for of_reserved_mem_lookup() in airoha_qdma_init_hfwd_queues() of_reserved_mem_lookup() may return NULL if the reserved memory region referenced by the "memory-region" phandle is not found in the reserved memory table (e.g. due to a misconfigured DTS or a removed memory-region node). The current code dereferences the returned pointer without checking for NULL, leading to a kernel NULL pointer dereference at the following lines: dma_addr = rmem->base; // line 1156 num_desc = div_u64(rmem->size, buf_size); // line 1160 Add a NULL check after of_reserved_mem_lookup() and return -ENODEV if the lookup fails, which is consistent with the existing error handling for of_parse_phandle() failure in the same code block.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-53338
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-53338
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-53338 (3)
Same Patch Batch · Linux · 2026-07-01 · 31 CVEs total
| CVE-2026-53342 | arm64: mm: call pagetable dtor when freeing hot-removed page tables | |
| CVE-2026-53326 | debugobjects: Don't call fill_pool() in early boot hardirq context | |
| CVE-2026-53327 | debugobjects: Do not fill_pool() if pi_blocked_on | |
| CVE-2026-53328 | sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task() | |
| CVE-2026-53329 | drm/amd/display: Use krealloc_array() in dal_vector_reserve() | |
| CVE-2026-53330 | drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() | |
| CVE-2026-53331 | slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock | |
| CVE-2026-53332 | slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd | |
| CVE-2026-53334 | mm/damon/reclaim: handle ctx allocation failure | |
| CVE-2026-53333 | mm/mincore: handle non-swap entries before !CONFIG_SWAP guard | |
| CVE-2026-53335 | mm/damon/lru_sort: handle ctx allocation failure | |
| CVE-2026-53336 | nvmem: layouts: onie-tlv: fix hang on unknown types | |
| CVE-2026-53337 | net: bonding: fix NULL pointer dereference in bond_do_ioctl() | |
| CVE-2026-53340 | i2c: imx: fix clock and pinctrl state inconsistency in runtime PM | |
| CVE-2026-53339 | i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() | |
| CVE-2026-53356 | drm/i915/gem: Fix phys BO pread/pwrite with offset | |
| CVE-2026-53341 | fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() | |
| CVE-2026-53343 | ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow | |
| CVE-2026-53344 | pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init | |
| CVE-2026-53345 | KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying |
Showing top 20 of 31 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-53356
drm/i915/gem: Fix phys BO pread/pwrite with offset - CVE-2026-53355
net: rds: clear i_sends on setup unwind - CVE-2026-53354
arm64: errata: Mitigate TLBI errata on various Arm CPUs - CVE-2026-53353
hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - CVE-2026-53351
riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI
Same vendor: Linux
- CVE-2026-53356
drm/i915/gem: Fix phys BO pread/pwrite with offset - CVE-2026-53355
net: rds: clear i_sends on setup unwind - CVE-2026-53354
arm64: errata: Mitigate TLBI errata on various Arm CPUs - CVE-2026-53353
hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - CVE-2026-53351
riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI
V. Comments for CVE-2026-53338
No comments yet