NULL pointer dereference in Linux kernel - CVE-2026-53339
Published: July 2, 2026
Vulnerability identifier: #VU136709
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-53339
CWE-ID: CWE-476
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a NULL pointer dereference in cci_remove() in the i2c-qcom-cci driver when removing or unbinding the driver on systems where only one I2C master is initialized. A local user can trigger device unbinding or driver removal to cause a denial of service.
Only systems where the Qualcomm CCI controller exposes two I2C masters but only one master is enabled are affected.
How to mitigate CVE-2026-53339
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/4cd206c1d57a9370d5219f7b1fc45169d7bdf951
- https://git.kernel.org/stable/c/4d2b4a9cda6837e5ee1de1290f2e773a713b71e9
- https://git.kernel.org/stable/c/7107627b8b35015027201e7a095a3f6e30b4a46f
- https://git.kernel.org/stable/c/729ac5a4b966aac42e08a94dea966f4429008548
- https://git.kernel.org/stable/c/8ce7ff721a5e9d06d53ef65d01c89fce6d26d6ff
- https://git.kernel.org/stable/c/a162a260c8c4db7501c65220e76913e8e351f823
- https://git.kernel.org/stable/c/a50b8adb9cdb9a495b0b45583956897b7411ed7a
- https://git.kernel.org/stable/c/e8669d12da0ade52adfe0abe96cd99e708abc9bd