CVE-2026-53298 net: airoha: Move ndesc initialization at end of airoha_qdma_init_rx_queue()
A NULL pointer dereference in the Airoha QDMA driver can cause a kernel crash if memory allocation fails during RX queue initialization.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53298?
CVE-2026-53298 is a medium-severity vulnerability in Linux kernel, published on 26 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: airoha: Move ndesc initialization at end of airoha_qdma_init_rx_queue()
If queue entry or DMA descriptor list allocation fails in airoha_qdma_init_rx_queue routine, airoha_qdma_cleanup() will trigger a NULL pointer dereference running netif_napi_del() for RX queue NAPIs since netif_napi_add() has never been executed to this particular RX NAPI. The issue is due to the early ndesc initialization in airoha_qdma_init_rx_queue() since airoha_qdma_cleanup() relies on ndesc value to check if the queue is properly initialized. Fix the issue moving ndesc initialization at end of airoha_qdma_init_tx routine. Move page_pool allocation after descriptor list allocation in order to avoid memory leaks if desc allocation fails.
Weakness: CWE-476
Which versions are affected by CVE-2026-53298?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53298?
Apply the vendor's patch.
Is CVE-2026-53298 being exploited?
There is no known exploitation of CVE-2026-53298 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-53298, DEBIAN-CVE-2026-53298, GHSA-qvrw-vpg6-fx6m, UBUNTU-CVE-2026-53298.