SB2026062597 - NULL pointer dereference in Linux kernel md driver
Published: June 25, 2026
Security Bulletin ID
SB2026062597
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) NULL pointer dereference (CVE-ID: CVE-2026-53064)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a null pointer dereference in the dm-cache target when handling concurrent writes in passthrough mode during cache entry invalidation. A local user can trigger concurrent writes to the same cached block to cause a denial of service.
Only the passthrough mode code path is affected.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/01264a6a3a3ad7ac1d73443299cd5a9568002454
- https://git.kernel.org/stable/c/0aa745fea1f8dc81bcdd0a45e215b6706727b482
- https://git.kernel.org/stable/c/25dcc1989c194ba2b5fb6d03cbb9b83814ac0d15
- https://git.kernel.org/stable/c/7d1f98d668ee34c1d15bdc0420fdd062f24a27c0
- https://git.kernel.org/stable/c/a2635d541a93fd111e743cf14b6275dc81be2abc
- https://git.kernel.org/stable/c/c7fb6bc864c4910b344dafa36dd5028e9b980768
- https://git.kernel.org/stable/c/df3b8ef06cc62de4fca5d2108e285085b3cffd44
- https://git.kernel.org/stable/c/ee38fb00e1a80f46a4990e38f25ecb04ae7b7417