CVE-2026-53338: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53338 Overview

CVE-2026-53338 is a NULL pointer dereference vulnerability in the Linux kernel's Airoha network driver. The flaw resides in the airoha_qdma_init_hfwd_queues() function within the QDMA initialization path. When of_reserved_mem_lookup() fails to locate the reserved memory region referenced by the memory-region phandle, it returns NULL. The driver code then dereferences this NULL pointer to access rmem->base and rmem->size, triggering a kernel crash. The condition arises from a misconfigured Device Tree Source (DTS) or a removed memory-region node. The upstream fix adds a NULL check and returns -ENODEV when the lookup fails.

Critical Impact
A NULL pointer dereference in the Airoha QDMA driver initialization path can cause a kernel oops and denial of service on affected devices during driver load.

Affected Products

Linux kernel versions containing the Airoha QDMA driver prior to the referenced fix commits
Systems using the Airoha network driver (net/airoha) with Device Tree configurations
Embedded and networking platforms leveraging Airoha SoCs with QDMA hardware forwarding

Discovery Timeline

2026-07-01 - CVE-2026-53338 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-53338

Vulnerability Analysis

The vulnerability is a NULL pointer dereference [CWE-476] in the Linux kernel's Airoha QDMA network driver. Specifically, airoha_qdma_init_hfwd_queues() calls of_reserved_mem_lookup() to resolve a reserved memory region referenced by a Device Tree memory-region phandle. The function returns a pointer to a reserved_mem structure on success and NULL on failure. The original code did not validate the returned pointer before dereferencing it.

At line 1156, the driver executes dma_addr = rmem->base; and at line 1160 it computes num_desc = div_u64(rmem->size, buf_size);. Both accesses dereference rmem without a NULL check, which leads to a kernel oops when the lookup fails. The failure condition occurs when the phandle references a node that is not present in the reserved memory table, such as when the DTS has been misconfigured or the memory-region node has been removed.

Root Cause

The root cause is missing return value validation. The driver assumed of_reserved_mem_lookup() would always succeed after the preceding of_parse_phandle() call. In practice, the phandle may resolve to a node that never registered as reserved memory, causing the lookup to return NULL while the phandle itself is valid.

Attack Vector

Exploitation requires the ability to influence the kernel's Device Tree configuration or the presence of a misconfigured DTS at boot. This is not a remotely exploitable condition. The impact is limited to a local denial of service on systems where the Airoha QDMA driver initializes with a broken DTS. See the kernel commit adding the NULL check for the specific code path.

No verified proof-of-concept code is available. The vulnerability is described in prose based on the upstream commit message.

Detection Methods for CVE-2026-53338

Indicators of Compromise

Kernel oops or panic messages referencing airoha_qdma_init_hfwd_queues in dmesg or system logs
Failed initialization of the Airoha QDMA network interface at boot
Device Tree entries referencing a memory-region phandle without a corresponding reserved memory node

Detection Strategies

Audit kernel version strings against the fixed commits 01f7d4b5, cdb96c42, and f9f25118 published in the kernel stable tree.
Review Device Tree Source files on affected platforms to confirm every memory-region phandle resolves to a valid reserved-memory child node.
Monitor kernel logs for repeated crashes tied to the net/airoha driver during boot or module load.

Monitoring Recommendations

Aggregate kernel crash telemetry from embedded Linux fleets and alert on airoha_qdma symbol references.
Track kernel package versions across networking appliances and flag hosts running pre-patch builds.
Correlate boot-time driver failures with Device Tree changes introduced by firmware updates.

How to Mitigate CVE-2026-53338

Immediate Actions Required

Apply the upstream kernel patches referenced in the Linux stable commit tree to systems running the Airoha QDMA driver.
Validate Device Tree Source files to ensure every memory-region phandle points to a node declared under reserved-memory.
Rebuild and redeploy vendor kernels that ship the Airoha driver after incorporating the fix.

Patch Information

The fix adds a NULL check after of_reserved_mem_lookup() and returns -ENODEV when the lookup fails, matching the existing error handling for of_parse_phandle() failures. Fixed commits are available at 01f7d4b5, cdb96c42, and f9f25118.

Workarounds

Correct the Device Tree so that all referenced memory-region phandles resolve to valid reserved memory nodes, preventing the failure path from executing.
Disable or blacklist the Airoha QDMA driver on systems where hardware forwarding is not required until the patched kernel is deployed.
Restrict physical and administrative access to devices that load unverified Device Tree blobs to reduce exposure to the crash condition.

bash

# Verify kernel version and check for the fix commit
uname -r
zcat /proc/config.gz | grep -i airoha
dmesg | grep -i "airoha_qdma"