CVE-2026-53332
Estado: ModificadaMedia (5.5)—
In the Linux kernel, the following vulnerability has been resolved:
slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd
When the remoteproc starts in parallel with the NGD driver being probed, or the remoteproc is already up when the PDR lookup is being registered, or in the theoretical event that we get an interrupt from the hardware, these callbacks will operate on uninitialized data. This result in issues to boot the affected boards.
One such example can be seen in the following fault, where qcom_slim_ngd_ssr_pdr_notify() schedules work on the NULL ngd_up_work.
Move the enablement of interrupts, and the registration of SSR and PDR until after the NGD device has been registered.
Leer descripción completaMostrar menos
This could be further refined by moving initialization to the control driver probe and by removing the platform driver model from the picture.
Detalles técnicos trazas, registros y código del informe original
[ 21.858578] ------------[ cut here ]------------ [ 21.858745] WARNING: kernel/workqueue.c:2338 at __queue_work+0x5e0/0x790, CPU#2: kworker/2:2/116 ... [ 21.859251] Call trace: [ 21.859255] __queue_work+0x5e0/0x790 (P) [ 21.859265] queue_work_on+0x6c/0xf0 [ 21.859273] qcom_slim_ngd_ssr_pdr_notify+0x110/0x150 [slim_qcom_ngd_ctrl] [ 21.859304] qcom_slim_ngd_ssr_notify+0x24/0x40 [slim_qcom_ngd_ctrl] [ 21.859318] notifier_call_chain+0xa4/0x230 [ 21.859329] srcu_notifier_call_chain+0x64/0xb8 [ 21.859338] ssr_notify_start+0x40/0x78 [qcom_common] [ 21.859355] rproc_start+0x130/0x230 [ 21.859367] rproc_boot+0x3d4/0x518 ...
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 5.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.13%
- Percentil entre todas las CVEs puntuadas: 2
- Fecha de la puntuación: 3/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- NVD-CWE-noinfo
Referencias
- https://git.kernel.org/stable/c/08564e15c47a5fb0af6643a43ee15521d49bcdea
- https://git.kernel.org/stable/c/2047eeb38db878a31f58db19d98f8aedf284342e
- https://git.kernel.org/stable/c/24ec89123fc9d0d24ce719dcf7fd6c57e5b0d753
- https://git.kernel.org/stable/c/290014c7987636e6105bba89fa04cb4d59f775c1
- https://git.kernel.org/stable/c/2a9d50e9ea406e0c8735938484adc20515ef1b47
- https://git.kernel.org/stable/c/946b97d632f0f58a705dafac644c1e9346e01f35
- https://git.kernel.org/stable/c/afc631e246936a40558f494112a4188401382671
- https://git.kernel.org/stable/c/fa3790c7ea98328ddc3f7d8bf40247556245a6fc
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-53332",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "917809e2280bb83994be8b642373fd941d40c407",
"lessThan": "946b97d632f0f58a705dafac644c1e9346e01f35",
"versionType": "git"
},
{
"status": "affected",
"version": "917809e2280bb83994be8b642373fd941d40c407",
"lessThan": "2047eeb38db878a31f58db19d98f8aedf284342e",
"versionType": "git"
},
{
"status": "affected",
"version": "917809e2280bb83994be8b642373fd941d40c407",
"lessThan": "afc631e246936a40558f494112a4188401382671",
"versionType": "git"
},
{
"status": "affected",
"version": "917809e2280bb83994be8b642373fd941d40c407",
"lessThan": "290014c7987636e6105bba89fa04cb4d59f775c1",
"versionType": "git"
},
{
"status": "affected",
"version": "917809e2280bb83994be8b642373fd941d40c407",
"lessThan": "fa3790c7ea98328ddc3f7d8bf40247556245a6fc",
"versionType": "git"
},
{
"status": "affected",
"version": "917809e2280bb83994be8b642373fd941d40c407",
"lessThan": "24ec89123fc9d0d24ce719dcf7fd6c57e5b0d753",
"versionType": "git"
},
{
"status": "affected",
"version": "917809e2280bb83994be8b642373fd941d40c407",
"lessThan": "08564e15c47a5fb0af6643a43ee15521d49bcdea",
"versionType": "git"
},
{
"status": "affected",
"version": "917809e2280bb83994be8b642373fd941d40c407",
"lessThan": "2a9d50e9ea406e0c8735938484adc20515ef1b47",
"versionType": "git"
}
],
"programFiles": [
"drivers/slimbus/qcom-ngd-ctrl.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.19",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver",
"lessThanOrEqual": "7.0.*"
},
{
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/slimbus/qcom-ngd-ctrl.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-07-01T14:16:41.137",
"references": [
{
"url": "https://git.kernel.org/stable/c/08564e15c47a5fb0af6643a43ee15521d49bcdea",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2047eeb38db878a31f58db19d98f8aedf284342e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/24ec89123fc9d0d24ce719dcf7fd6c57e5b0d753",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/290014c7987636e6105bba89fa04cb4d59f775c1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2a9d50e9ea406e0c8735938484adc20515ef1b47",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/946b97d632f0f58a705dafac644c1e9346e01f35",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/afc631e246936a40558f494112a4188401382671",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/fa3790c7ea98328ddc3f7d8bf40247556245a6fc",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nslimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd\n\nWhen the remoteproc starts in parallel with the NGD driver being probed,\nor the remoteproc is already up when the PDR lookup is being registered,\nor in the theoretical event that we get an interrupt from the hardware,\nthese callbacks will operate on uninitialized data. This result in\nissues to boot the affected boards.\n\nOne such example can be seen in the following fault, where\nqcom_slim_ngd_ssr_pdr_notify() schedules work on the NULL ngd_up_work.\n\n[ 21.858578] ------------[ cut here ]------------\n[ 21.858745] WARNING: kernel/workqueue.c:2338 at __queue_work+0x5e0/0x790, CPU#2: kworker/2:2/116\n...\n[ 21.859251] Call trace:\n[ 21.859255] __queue_work+0x5e0/0x790 (P)\n[ 21.859265] queue_work_on+0x6c/0xf0\n[ 21.859273] qcom_slim_ngd_ssr_pdr_notify+0x110/0x150 [slim_qcom_ngd_ctrl]\n[ 21.859304] qcom_slim_ngd_ssr_notify+0x24/0x40 [slim_qcom_ngd_ctrl]\n[ 21.859318] notifier_call_chain+0xa4/0x230\n[ 21.859329] srcu_notifier_call_chain+0x64/0xb8\n[ 21.859338] ssr_notify_start+0x40/0x78 [qcom_common]\n[ 21.859355] rproc_start+0x130/0x230\n[ 21.859367] rproc_boot+0x3d4/0x518\n...\n\nMove the enablement of interrupts, and the registration of SSR and PDR\nuntil after the NGD device has been registered.\n\nThis could be further refined by moving initialization to the control\ndriver probe and by removing the platform driver model from the picture."
}
],
"lastModified": "2026-07-24T15:18:00.473",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D7B73EF6-B912-4B7F-90ED-D4988069F2BD",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "4.19"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5A025BA0-231F-40C2-B6CC-35FBA3749B56",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "5.11"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "389025D2-958D-41BD-BD96-70ED1033A9F3",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "6.13"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6A64BF9F-3BCA-42FD-98CB-8F03474D2B1E",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "6.19"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B0E8FC71-3952-444C-83E9-718DBBBEC615"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1039E95A-8CC3-4C88-8FF9-5C08EEB861C9"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}