SB20260626196 - NULL pointer dereference in Linux kernel mmc host driver

Description

This security bulletin contains information about 1 vulnerability.

1) NULL pointer dereference (CVE-ID: CVE-2026-53152)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL-pointer dereference in the dw_mmc-rockchip driver when initializing very old Rockchip MMC controllers. A local user can trigger initialization of an affected controller to cause a denial of service.

The issue affects rk2928, rk3066, and rk3188 controllers that do not support UHS speeds and therefore lacked driver private data for phase handling.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1e9a4850afa0ceb63984fb1a9f3e86d0fc4fd18f
• https://git.kernel.org/stable/c/7f8007be13e6cc1e0a508fe461f9a91ba9a28b8c
• https://git.kernel.org/stable/c/8d9eca906e76d3dd40e5f2c79701f066678f2e62
• https://git.kernel.org/stable/c/b1180ff50cca48807893ecde7d1f81d573c88c85