CVE-2026-53332: slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd
In the Linux kernel, the following vulnerability has been resolved:
slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd
When the remoteproc starts in parallel with the NGD driver being probed, or the remoteproc is already up when the PDR lookup is being registered, or in the theoretical event that we get an interrupt from the hardware, these callbacks will operate on uninitialized data. This result in issues to boot the affected boards.
One such example can be seen in the following fault, where qcomslimngdssrpdrnotify() schedules work on the NULL ngdupwork.
[ 21.858578] ------------[ cut here ]------------ [ 21.858745] WARNING: kernel/workqueue.c:2338 at queuework+0x5e0/0x790, CPU#2: kworker/2:2/116 ... [ 21.859251] Call trace: [ 21.859255] queuework+0x5e0/0x790 (P) [ 21.859265] queueworkon+0x6c/0xf0 [ 21.859273] qcomslimngdssrpdrnotify+0x110/0x150 [slimqcomngdctrl] [ 21.859304] qcomslimngdssrnotify+0x24/0x40 [slimqcomngdctrl] [ 21.859318] notifiercallchain+0xa4/0x230 [ 21.859329] srcunotifiercallchain+0x64/0xb8 [ 21.859338] ssrnotifystart+0x40/0x78 [qcomcommon] [ 21.859355] rprocstart+0x130/0x230 [ 21.859367] rprocboot+0x3d4/0x518 ...
Move the enablement of interrupts, and the registration of SSR and PDR until after the NGD device has been registered.
This could be further refined by moving initialization to the control driver probe and by removing the platform driver model from the picture.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the slimbus qcom-ngd-ctrl code so that SSR/PDR notification callbacks are registered only after the NGD device has been created/registered (so that qcom_slim_ngd_ssr_pdr_notify no longer schedules work on an uninitialized/null ngd_up_work during parallel remoteproc start and driver probe).
Linux kernel (slimbus: qcom-ngd-ctrl driver) Register callbacks after creating the ngd / SSR and PDR registration order = After NGD device registration (defer SSR/PDR callback registration until ngd is created/registered) - Configuration
Move the enablement of interrupts and the registration of SSR and PDR so initialization occurs before interrupts/callbacks can trigger, preventing the notifier/workqueue path from operating on uninitialized data.
Linux kernel (slimbus: qcom-ngd-ctrl driver) Enablement of interrupts vs SSR/PDR registration order = Enable interrupts after moving initialization and SSR/PDR registration
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53332?
The severity of CVE-2026-53332 is classified as medium with a CVSS score of 5.5.
What does the CVE-2026-53332 vulnerability affect?
CVE-2026-53332 affects the slimbus module in the Linux kernel.
How can I mitigate CVE-2026-53332?
To mitigate CVE-2026-53332, ensure that the Linux kernel is updated to the latest version where the vulnerability has been fixed.
What systems are vulnerable to CVE-2026-53332?
Systems running an affected version of the Linux kernel with the slimbus module loaded are vulnerable to CVE-2026-53332.
What is the impact of exploiting CVE-2026-53332?
Exploiting CVE-2026-53332 can lead to a denial of service condition.