CVE-2026-53042: fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal
In the Linux kernel, the following vulnerability has been resolved:
fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal
CXL is linked before fwctl in drivers/Makefile. Both use moduleinit, so cxlpcidriverinit() runs first. When cxlpciprobe() calls fwctlregister() and then deviceadd(), fwctlclass is not yet registered because fwctlinit() hasn't run, causing classtosubsys() to return NULL and skip knodeclass initialization.
On device removal, classtosubsys() returns non-NULL, and devicedel() calls klistdel() on the uninitialized knode, triggering a NULL pointer dereference.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53042?
CVE-2026-53042 has a medium severity rating of 5.5 according to the CVSS 3.1 metrics.
How do I fix CVE-2026-53042?
To fix CVE-2026-53042, apply the patch that has been made available for this vulnerability.
What type of vulnerability is CVE-2026-53042?
CVE-2026-53042 is classified as a Null Pointer Dereference vulnerability.
Which software is affected by CVE-2026-53042?
CVE-2026-53042 affects the Linux kernel and related components in the Linux Foundation.
When was CVE-2026-53042 published?
CVE-2026-53042 was published on June 24, 2026.