CVE-2026-53152: Linux Kernel dw_mmc-rockchip Vulnerability

CVE-2026-53152 Overview

CVE-2026-53152 affects the Linux kernel's dw_mmc-rockchip MMC host driver. The flaw causes a NULL pointer dereference on older Rockchip system-on-chip (SoC) platforms, specifically rk2928, rk3066, and rk3188. These controllers do not support Ultra High Speed (UHS) modes and historically lacked a parse_dt callback or driver private data structure.

Commit ff6f0286c896 ("mmc: dw_mmc-rockchip: Add memory clock auto-gating support") made the private data structure effectively mandatory. The init function dereferences the structure when checking how phases are configured. Older SoCs reach this code path without a populated private data struct and trigger a kernel-mode NULL pointer dereference [CWE-476].

Critical Impact
A NULL pointer dereference in the MMC subsystem at driver initialization can cause a kernel oops or panic on affected Rockchip platforms, leading to denial of service during boot or MMC subsystem load.

Affected Products

Linux kernel dw_mmc-rockchip driver on rk2928 SoC platforms
Linux kernel dw_mmc-rockchip driver on rk3066 SoC platforms
Linux kernel dw_mmc-rockchip driver on rk3188 SoC platforms

Discovery Timeline

2026-06-25 - CVE-2026-53152 published to the National Vulnerability Database (NVD)
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53152

Vulnerability Analysis

The dw_mmc-rockchip driver provides MMC/SD host controller support for Rockchip SoCs in the Linux kernel. The driver originally supported a range of controllers, with newer variants requiring tunable phase data for UHS speed modes. Older controllers, including rk2928, rk3066, and rk3188, were excluded from this configuration because they do not implement UHS signaling.

The regression introduced by commit ff6f0286c896 added memory clock auto-gating support and centralized phase configuration logic. The new init flow reads fields from a driver private data structure without first verifying that the structure was allocated. On the older SoCs, this structure was never registered, so the dereference occurs on a NULL pointer.

Exploitation requires no authentication or remote interaction. Triggering the issue requires physical hardware (or an emulated platform) running an affected kernel on one of the listed Rockchip SoCs. Impact is limited to local availability — a kernel oops or panic during driver probe.

Root Cause

The root cause is missing initialization of driver-specific data for legacy controller variants. The init path assumes every variant registers a private data structure describing phase configuration sources. When the structure pointer is NULL, the kernel dereferences it and faults.

Attack Vector

The issue is reachable during kernel boot or MMC driver probe on affected hardware. There is no remote attack vector. An attacker with local access to an affected device could induce a denial of service by triggering driver re-probe, but exploitation is incidental rather than weaponizable for code execution.

No verified exploit code or proof-of-concept has been published. Refer to the upstream patches for technical details:

Detection Methods for CVE-2026-53152

Indicators of Compromise

Kernel oops or panic messages referencing dw_mci_rockchip_init or the dw_mmc-rockchip module during boot
BUG reports with NULL pointer dereference in dmesg correlated with MMC subsystem initialization
Repeated reboot loops on Rockchip rk2928, rk3066, or rk3188 devices after a kernel upgrade containing commit ff6f0286c896

Detection Strategies

Inventory deployed Linux kernel versions across embedded and IoT fleets to identify hosts running kernel builds that include the regressing commit
Parse kernel logs and crash dumps for NULL pointer dereference signatures originating in the dw_mmc-rockchip driver
Correlate device-tree compatible strings for rockchip,rk2928-dw-mshc, rockchip,rk3066-dw-mshc, and rockchip,rk3188-dw-mshc with kernel build metadata

Monitoring Recommendations

Forward dmesg and journalctl -k output from embedded Linux fleets to a centralized log platform for kernel fault analysis
Alert on unexpected kernel panic events or repeated MMC probe failures on Rockchip-based hardware
Track Linux kernel stable release advisories to confirm backports of the fix into long-term support branches

How to Mitigate CVE-2026-53152

Immediate Actions Required

Identify all systems running affected kernel versions on rk2928, rk3066, or rk3188 hardware
Apply the upstream Linux kernel patches that add the missing private data structure for the legacy Rockchip MMC controller variants
For vendors maintaining custom kernels, cherry-pick the fix commits into downstream branches and rebuild affected board support packages
Test MMC subsystem initialization on representative hardware before pushing kernel updates to production fleets

Patch Information

The fix adds the missing driver private data structure for the older rk2928, rk3066, and rk3188 controller variants so the init path can safely read phase configuration fields. The corrective commits are published in the upstream Linux kernel stable tree at 1e9a4850afa0, 7f8007be13e6, 8d9eca906e76, and b1180ff50cca.

Workarounds

Pin affected devices to a kernel revision prior to commit ff6f0286c896 until patched builds are deployed
Where feasible, disable the dw_mmc-rockchip driver via kernel configuration or module blacklist on hardware that does not require MMC functionality
Restrict physical access to affected embedded devices to reduce opportunistic denial-of-service triggering

bash

# Verify kernel version and Rockchip SoC identification on an affected device
uname -r
cat /proc/device-tree/compatible | tr '\0' '\n'

# Inspect kernel ring buffer for NULL pointer dereferences in the MMC driver
dmesg | grep -iE 'dw_mmc|null pointer|mmc'