SB2026062962 - NULL pointer dereference in Linux kernel ethernet mediatek driver

Description

This security bulletin contains information about 1 vulnerability.

1) NULL pointer dereference (CVE-ID: CVE-2026-53298)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in airoha_qdma_cleanup() when cleaning up a partially initialized RX queue after allocation failures in airoha_qdma_init_rx_queue(). A local user can trigger queue initialization failure to cause a denial of service.

The issue occurs because RX queue NAPI cleanup may be performed even though netif_napi_add() was never executed for the affected queue.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/14dc48e5ba73d5c69559bf1a1a6884f7843aade7
• https://git.kernel.org/stable/c/379050947a1828826ad7ea50c95245a56929b35a
• https://git.kernel.org/stable/c/4d4acfa348a1d8c0941004823662ede0fdb5dea5
• https://git.kernel.org/stable/c/d36be272adda7f313e39dd118086955d993bf6a7