CVE-2026-53332 Overview
CVE-2026-53332 affects the Linux kernel's slimbus: qcom-ngd-ctrl driver on Qualcomm platforms. The vulnerability stems from callbacks being registered before the Non-Generic Device (NGD) is created. When the remote processor (remoteproc) starts in parallel with the NGD driver probe, or when the remoteproc is already running during Protection Domain Restart (PDR) lookup registration, the callbacks operate on uninitialized data. This race condition triggers kernel warnings and prevents affected boards from booting correctly. The issue manifests as a WARNING in __queue_work+0x5e0/0x790 when qcom_slim_ngd_ssr_pdr_notify() schedules work on a NULL ngd_up_work structure.
Critical Impact
Uninitialized data access in the Qualcomm slimbus NGD controller can cause kernel warnings, boot failures, and potential denial of service on affected Qualcomm-based Linux systems.
Affected Products
- Linux kernel versions containing the slim_qcom_ngd_ctrl driver prior to the referenced stable commits
- Qualcomm-based platforms utilizing slimbus with NGD controllers
- Systems relying on remoteproc for slimbus subsystem initialization
Discovery Timeline
- 2026-07-01 - CVE-2026-53332 published to NVD
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-53332
Vulnerability Analysis
The vulnerability is a race condition [CWE-362] combined with uninitialized memory use in the Qualcomm slimbus NGD control driver. The driver registers Subsystem Restart (SSR) and Protection Domain Restart (PDR) notification callbacks before the NGD device has been fully initialized. When the remoteproc subsystem starts concurrently with the NGD driver probe, the notification callbacks fire against structures that have not yet been populated.
The reported kernel trace shows qcom_slim_ngd_ssr_pdr_notify() attempting to schedule work on a NULL ngd_up_work pointer. This triggers a warning in __queue_work and disrupts the boot sequence. Three race windows exist: parallel remoteproc and NGD probe execution, remoteproc already up when PDR lookup registers, and hardware interrupts arriving before initialization completes.
Root Cause
The root cause is improper initialization ordering in the driver probe path. Interrupt enablement and SSR/PDR notifier registration occur before the NGD device structure exists. Any callback invoked during this window dereferences uninitialized fields, including work queue pointers required by queue_work_on().
Attack Vector
This vulnerability is triggered by normal system boot conditions rather than remote attack. Exploitation requires local hardware timing conditions or specific initialization sequences that cause callbacks to fire against uninitialized NGD state. The impact is denial of service through boot failure on affected Qualcomm platforms. The patch reorders driver initialization to register callbacks and enable interrupts only after the NGD device has been registered. See the kernel stable commit for the applied fix.
Detection Methods for CVE-2026-53332
Indicators of Compromise
- Kernel warning messages referencing __queue_work+0x5e0/0x790 in dmesg output
- Call trace entries containing qcom_slim_ngd_ssr_pdr_notify or qcom_slim_ngd_ssr_notify
- Boot failures on Qualcomm platforms where the slimbus NGD driver is loaded
- WARNING: kernel/workqueue.c:2338 messages during system startup
Detection Strategies
- Monitor kernel logs during boot for warnings originating from the slim_qcom_ngd_ctrl module
- Track systemd or init failures correlating with slimbus subsystem initialization
- Compare running kernel versions against the fixed stable commits published on kernel.org
Monitoring Recommendations
- Aggregate dmesg and journalctl output from Qualcomm-based Linux fleets into a centralized logging platform
- Alert on any kernel WARNING traces containing qcom_slim_ngd function symbols
- Track boot success rates across affected hardware to identify systemic initialization failures
How to Mitigate CVE-2026-53332
Immediate Actions Required
- Inventory all Qualcomm-based Linux systems using the slim_qcom_ngd_ctrl driver
- Apply the upstream kernel patches referenced in the stable tree commits
- Rebuild and deploy kernels for affected embedded and mobile platforms
- Validate boot sequences after patch application on representative hardware
Patch Information
The Linux kernel maintainers resolved this issue by moving interrupt enablement and SSR/PDR registration until after NGD device registration completes. Patches are available in the stable tree commits 08564e15c47a, 24ec89123fc9, 2a9d50e9ea40, and fa3790c7ea98. Refer to the Kernel Git Commit for the canonical fix.
Workarounds
- Disable the slim_qcom_ngd_ctrl module if slimbus functionality is not required on the platform
- Serialize remoteproc and NGD driver initialization through custom init scripts where feasible
- Delay PDR lookup registration until after userspace confirms driver readiness on non-critical systems
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
