CVE-2026-53299: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53299 Overview

CVE-2026-53299 is a NULL pointer dereference vulnerability in the Linux kernel's Airoha network driver. The flaw resides in the airoha_qdma_init_tx_queue() routine within the net: airoha subsystem. When queue entry list allocation fails during transmit queue initialization, the cleanup path airoha_qdma_cleanup_tx_queue() accesses an uninitialized queue entry array. This access triggers a NULL pointer dereference, causing a kernel crash. The fix moves the ndesc initialization to the end of airoha_qdma_init_tx() to prevent premature access during error handling. This vulnerability affects systems running Linux kernel versions containing the Airoha QDMA driver.

Critical Impact
A failed transmit queue allocation triggers a kernel NULL pointer dereference, resulting in denial of service on affected Airoha-based networking hardware.

Affected Products

Linux kernel with the Airoha QDMA network driver enabled
Systems using Airoha-based network interface controllers
Distributions shipping vulnerable versions of the net/airoha driver

Discovery Timeline

2026-06-26 - CVE-2026-53299 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-53299

Vulnerability Analysis

The vulnerability exists in the Linux kernel Airoha QDMA (Queue-based Direct Memory Access) network driver. During transmit queue initialization, airoha_qdma_init_tx_queue() sets the ndesc field before allocating the queue entry list. If the subsequent queue entry list allocation fails, the driver invokes airoha_qdma_cleanup_tx_queue() to unwind the partial initialization.

The cleanup routine iterates over the queue entry array based on the ndesc count. Because ndesc was initialized before the allocation failure, the cleanup path attempts to dereference an array pointer that was never assigned. This produces a NULL pointer dereference in kernel context, which triggers a kernel oops or panic.

Root Cause

The root cause is improper ordering of initialization steps in the driver's error handling logic. Setting the descriptor count field before verifying successful allocation creates an inconsistent driver state. The cleanup function assumes any non-zero ndesc value corresponds to a valid entry array. This assumption breaks when allocation fails between the two operations, classifying the flaw as a NULL Pointer Dereference [CWE-476].

Attack Vector

Triggering the vulnerability requires conditions that cause the queue entry list allocation to fail, typically memory pressure during driver initialization. The issue surfaces on systems using Airoha networking hardware when the kernel cannot fulfill the allocation request. Successful triggering results in a kernel-level denial of service rather than code execution or privilege escalation. Local attackers with the ability to induce memory pressure during driver load could potentially force the condition.

The vulnerability manifests in the transmit queue initialization path. Refer to the upstream kernel commits for the exact code changes: Kernel commit 90619fde, Kernel commit ece31f9d, and Kernel commit f329924b.

Detection Methods for CVE-2026-53299

Indicators of Compromise

Kernel oops or panic messages referencing airoha_qdma_cleanup_tx_queue in system logs
NULL pointer dereference traces originating from the net/airoha driver module
Failed network interface initialization on Airoha-based hardware after boot

Detection Strategies

Monitor dmesg and /var/log/kern.log for kernel crash signatures involving Airoha driver symbols
Audit installed kernel versions against upstream stable trees to identify unpatched systems
Track network interface bring-up failures on hosts equipped with Airoha networking hardware

Monitoring Recommendations

Collect kernel crash dumps using kdump for post-incident analysis of Airoha driver faults
Forward kernel logs to a centralized logging platform for correlation across affected fleets
Alert on repeated kernel oops events tied to network driver initialization

How to Mitigate CVE-2026-53299

Immediate Actions Required

Apply the upstream Linux kernel patches that reorder ndesc initialization in airoha_qdma_init_tx()
Update to a stable kernel release containing commits 90619fde, ece31f9d, or f329924b
Inventory systems running Airoha-based network hardware to prioritize patching

Patch Information

The fix relocates the ndesc field assignment to the end of airoha_qdma_init_tx(), ensuring the descriptor count is only set after successful queue entry array allocation. The upstream fix is available in the following commits: 90619fdedfb9, ece31f9dae0c, and f329924bb494. Consult your Linux distribution vendor for backported updates.

Workarounds

Disable the Airoha QDMA driver on affected systems if the hardware is not required
Blacklist the airoha kernel module using /etc/modprobe.d/ configuration where feasible
Reduce memory pressure conditions during boot to minimize allocation failures in the driver init path

bash

# Configuration example
# Blacklist the airoha driver until the patched kernel is deployed
echo "blacklist airoha" | sudo tee /etc/modprobe.d/blacklist-airoha.conf
sudo update-initramfs -u