CVE-2026-53332 slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd
A race condition in the Qualcomm NGD controller driver causes a kernel crash when callbacks access uninitialized data during parallel initialization.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53332?
CVE-2026-53332 is a medium-severity vulnerability in Linux kernel, published on 1 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd
When the remoteproc starts in parallel with the NGD driver being probed, or the remoteproc is already up when the PDR lookup is being registered, or in the theoretical event that we get an interrupt from the hardware, these callbacks will operate on uninitialized data. This result in issues to boot the affected boards.
One such example can be seen in the following fault, where qcom_slim_ngd_ssr_pdr_notify() schedules work on the NULL ngd_up_work.
[ 21.858578] ------------[ cut here ]------------ [ 21.858745] WARNING: kernel/workqueue.c:2338 at __queue_work+0x5e0/0x790, CPU#2: kworker/2:2/116 ... [ 21.859251] Call trace: [ 21.859255] __queue_work+0x5e0/0x790 (P) [ 21.859265] queue_work_on+0x6c/0xf0 [ 21.859273] qcom_slim_ngd_ssr_pdr_notify+0x110/0x150 [slim_qcom_ngd_ctrl] [ 21.859304] qcom_slim_ngd_ssr_notify+0x24/0x40 [slim_qcom_ngd_ctrl] [ 21.859318] notifier_call_chain+0xa4/0x230 [ 21.859329] srcu_notifier_call_chain+0x64/0xb8 [ 21.859338] ssr_notify_start+0x40/0x78 [qcom_common] [ 21.859355] rproc_start+0x130/0x230 [ 21.859367] rproc_boot+0x3d4/0x518 ...
Move the enablement of interrupts, and the registration of SSR and PDR until after the NGD device has been registered.
This could be further refined by moving initialization to the control driver probe and by removing the platform driver model from the picture.
Which versions are affected by CVE-2026-53332?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53332?
Apply the vendor's patch.
Is CVE-2026-53332 being exploited?
There is no known exploitation of CVE-2026-53332 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-53332, DEBIAN-CVE-2026-53332, GHSA-4447-2m4q-w32j, ROOT-OS-DEBIAN-11-CVE-2026-53332, ROOT-OS-DEBIAN-12-CVE-2026-53332, ROOT-OS-UBUNTU-2204-CVE-2026-53332 and 2 more.