CVE-2026-53339 Overview
CVE-2026-53339 is a NULL pointer dereference vulnerability in the Linux kernel's i2c-qcom-cci driver affecting the Qualcomm Camera Control Interface (CCI) I2C controller. Modern Qualcomm platforms expose two I2C masters through the CCI controller, but boards may only initialize one master. When the driver is removed or the device unbinds, cci_remove() invokes cci_halt() for both masters, including the uninitialized one whose completion structure was never set up. The resulting NULL pointer dereference in wait_for_completion_timeout() triggers a kernel oops.
Critical Impact
Local users with the ability to unload the i2c-qcom-cci kernel module can trigger a kernel NULL pointer dereference, resulting in a denial of service on affected Qualcomm-based Linux systems.
Affected Products
- Linux kernel builds containing the i2c-qcom-cci driver
- Qualcomm platforms exposing the Camera Control Interface (CCI) I2C controller
- Boards initializing only a single I2C master on the dual-master CCI hardware
Discovery Timeline
- 2026-07-01 - CVE-2026-53339 published to NVD
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-53339
Vulnerability Analysis
The Qualcomm CCI controller hardware provides two I2C master interfaces per instance. The i2c-qcom-cci driver iterates over both masters during initialization and teardown. On boards where only one master is wired up, the driver initializes state — including the struct completion used to synchronize halt operations — only for the enabled master. The second master's completion remains uninitialized.
During module removal, cci_remove() calls cci_halt() unconditionally for both master indices. cci_halt() then invokes wait_for_completion_timeout() on the uninitialized completion, dereferencing NULL wait queue pointers inside __wait_for_common(). The kernel logs an oops with the call trace terminating in cci_remove+0xc4/0x138 and platform_driver_unregister.
The defect is classified as a NULL pointer dereference [CWE-476] in kernel driver removal logic. Exploitation requires local access and the ability to trigger driver unbind or module removal, which is typically restricted to privileged users.
Root Cause
The driver's remove path lacks a guard to skip masters that were never initialized. The completion structure is conditionally initialized based on device-tree configuration, but the teardown loop unconditionally waits on it. This asymmetry between initialization and cleanup paths produces the NULL dereference when the second master is absent from the board configuration.
Attack Vector
A local user with CAP_SYS_MODULE capability, or a system administrator invoking rmmod i2c-qcom-cci or unbinding the device via sysfs, can reliably trigger the crash on affected boards. Automated hardware test frameworks and hotplug scripts that unload camera-related modules are the most likely path to encountering the issue in production.
The upstream fix adds a check to ensure cci_halt() only waits on completions that were actually initialized, aligning teardown with the conditional initialization logic. See the Linux Kernel Commit 4cd206c and related stable backports for implementation details.
Detection Methods for CVE-2026-53339
Indicators of Compromise
- Kernel oops entries in dmesg or /var/log/kern.log containing Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
- Call trace referencing cci_remove, wait_for_completion_timeout, and i2c_qcom_cci
- Unexpected reboots or camera subsystem failures on Qualcomm-based devices after module unload
Detection Strategies
- Inventory Qualcomm-based Linux devices running vulnerable kernel versions and check whether the i2c-qcom-cci module is loaded via lsmod
- Monitor kernel ring buffer output for oops signatures matching the cci_remove call trace
- Audit systemd journal entries and crash dumps for panics originating in the i2c_qcom_cci module
Monitoring Recommendations
- Forward /var/log/kern.log and journalctl -k output to a centralized logging pipeline for kernel crash pattern matching
- Alert on rmmod or driver unbind operations against i2c-qcom-cci on production devices
- Track kernel version drift across Qualcomm-based fleets to confirm patch coverage
How to Mitigate CVE-2026-53339
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the stable tree commits and rebuild affected kernels
- Restrict CAP_SYS_MODULE and root shell access on Qualcomm-based systems to prevent arbitrary module unload
- Avoid manual rmmod i2c-qcom-cci operations on boards known to expose only a single CCI I2C master until patched
Patch Information
The fix is available across multiple stable branches. Reference the upstream commits: 4cd206c, 4d2b4a9, 7107627, 729ac5a, 8ce7ff7, a162a26, a50b8ad, and e8669d1. Distribution maintainers should pull the appropriate backport for their supported stable series.
Workarounds
- Blacklist manual removal of i2c-qcom-cci via /etc/modprobe.d/ configuration on production systems where camera functionality is required only at boot
- Restrict access to sysfs driver unbind interfaces such as /sys/bus/platform/drivers/qcom-cci/unbind using strict filesystem permissions
- Delay driver removal automation in hardware validation scripts until the fixed kernel is deployed
# Prevent unprivileged unload of the affected module
echo 'install i2c-qcom-cci /bin/false' | sudo tee /etc/modprobe.d/blacklist-cve-2026-53339.conf
# Verify current kernel version and module status
uname -r
lsmod | grep i2c_qcom_cci
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
