CVE-2026-53298 Overview
CVE-2026-53298 is a null pointer dereference vulnerability in the Linux kernel's Airoha network driver. The flaw resides in the airoha_qdma_init_rx_queue() routine used to initialize RX queues for the Airoha Queue DMA (QDMA) subsystem. When queue entry or DMA descriptor list allocation fails during initialization, the cleanup path airoha_qdma_cleanup() calls netif_napi_del() on an RX NAPI that was never registered with netif_napi_add(). The result is a null pointer dereference that leads to a kernel crash. The issue is caused by premature initialization of the ndesc field, which airoha_qdma_cleanup() uses to determine whether a queue is properly initialized.
Critical Impact
A failed RX queue initialization triggers a kernel null pointer dereference during cleanup, resulting in denial of service on affected systems using the Airoha network driver.
Affected Products
- Linux kernel versions containing the Airoha QDMA network driver prior to the fix
- Systems using Airoha Ethernet controllers with the airoha_eth driver
- Stable kernel branches referenced in the upstream backport commits
Discovery Timeline
- 2026-06-26 - CVE-2026-53298 published to NVD
- 2026-06-30 - Last updated in NVD database
Technical Details for CVE-2026-53298
Vulnerability Analysis
The vulnerability exists in the Airoha QDMA driver's RX queue initialization routine. The function airoha_qdma_init_rx_queue() sets the ndesc field early in the initialization sequence, before allocating queue entries and the DMA descriptor list. If either allocation fails, the driver invokes airoha_qdma_cleanup() to release resources.
The cleanup routine uses the ndesc value as a sentinel to determine which RX queues are initialized. Because ndesc is set before NAPI registration, cleanup proceeds to call netif_napi_del() on an RX NAPI structure that was never passed to netif_napi_add(). Dereferencing the unregistered NAPI structure produces a kernel null pointer dereference and system crash.
A related memory leak also exists in the same routine. The page_pool allocation occurs before the descriptor list is allocated, so a descriptor allocation failure leaks the previously allocated page pool.
Root Cause
The root cause is incorrect ordering of state initialization in airoha_qdma_init_rx_queue(). Assigning ndesc before completing the resource allocations and NAPI registration breaks the invariant that airoha_qdma_cleanup() relies on to identify fully constructed queues. This is a null pointer dereference condition tied to improper error handling during initialization.
Attack Vector
The vulnerability is triggered by allocation failure conditions during driver initialization on hardware using the Airoha QDMA network controller. Triggering the fault typically requires memory pressure or fault injection during driver load. Successful triggering causes a kernel crash, resulting in denial of service. The condition is not remotely exploitable and does not provide code execution or privilege escalation.
The upstream fix moves the ndesc initialization to the end of the initialization routine and reorders the page_pool allocation to occur after the descriptor list allocation. See the Kernel Git Commit 4d4acfa for the patch content.
Detection Methods for CVE-2026-53298
Indicators of Compromise
- Kernel oops or panic messages referencing netif_napi_del invoked from airoha_qdma_cleanup
- Boot-time or module load failures in the airoha_eth driver followed by a null pointer dereference stack trace
- dmesg entries showing DMA descriptor or page pool allocation failures immediately preceding a crash
Detection Strategies
- Inspect running kernel version against the fixed stable branches listed in the upstream commits
- Review crash dumps and kdump captures for stack traces involving airoha_qdma_init_rx_queue and airoha_qdma_cleanup
- Query package inventory data across Linux fleets to identify hosts running affected kernel versions with the Airoha driver loaded
Monitoring Recommendations
- Forward kernel logs to a centralized log platform and alert on airoha_qdma error patterns
- Monitor host availability for unexpected reboots on systems using Airoha network hardware
- Track kernel package versions in configuration management databases to confirm patch deployment
How to Mitigate CVE-2026-53298
Immediate Actions Required
- Identify systems running the Airoha QDMA driver (airoha_eth) and inventory their kernel versions
- Apply the stable kernel updates that include the upstream fix commits
- Reboot affected systems after patching to load the corrected kernel image
Patch Information
The fix is available in the following upstream commits: Kernel Git Commit 14dc48e, Kernel Git Commit 3790509, Kernel Git Commit 4d4acfa, and Kernel Git Commit d36be27. The patches move ndesc initialization to the end of airoha_qdma_init_rx_queue() and reorder page_pool allocation to prevent the memory leak on descriptor allocation failure.
Workarounds
- Where hardware permits, unload or blacklist the airoha_eth module until a patched kernel is available
- Reduce memory pressure at boot to lower the probability of allocation failures during driver initialization
- Constrain untrusted local workloads that could induce out-of-memory conditions on affected hosts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
