What’s Vulnerable › Vulnerabilities

CVE-2026-53299: net: airoha: Move ndesc initialization at end of airoha_qdma_init_tx()

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-26 · updated 2026-07-08
• Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Move ndesc initialization at end of airoha_qdma_init_tx() If queue entry list allocation fails in airoha_qdma_init_tx_queue routine, airoha_qdma_cleanup_tx_queue() will trigger a NULL pointer dereference accessing the queue entry array. The issue is due to the early ndesc initialization in airoha_qdma_init_tx_queue(). Fix the issue moving ndesc initialization at end of airoha_qdma_init_tx routine.

Affected products

• Linux kernel: from 6.19 before 7.0.10 — fixed in 7.0.10

How to fix

Upgrade to a fixed version: Linux kernel 7.0.10. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/90619fdedfb9cc8a80f217d882ee7a84d3703e72
• https://git.kernel.org/stable/c/ece31f9dae0c3cd3277e66667e7b8ab2577cf34a
• https://git.kernel.org/stable/c/f329924bb49458c65297f1361f545816a5b90998

Get alerted when CVE-2026-53299 or the next vulnerability affects your stack