CVE-2026-53042
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In the Linux kernel, a vulnerability was found due to incorrect class initialization ordering in the fwctl driver. When the CXL module is loaded before fwctl, the fwctl class registration is not yet complete, causing the knode_class initialization to be skipped. On device removal, a NULL pointer dereference occurs.
Risk Assessment
The risk involves a potential kernel panic or system crash during CXL device removal, which could disrupt critical services.
Recommendation
Apply the Linux kernel patch that fixes the fwctl class initialization ordering to ensure proper device removal handling.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal CXL is linked before fwctl in drivers/Makefile. Both use `module_init, so `cxl_pci_driver_init()` runs first. When `cxl_pci_probe()` calls `fwctl_register()` and then `device_add()`, fwctl_class is not yet registered because fwctl_init() hasn't run, causing `class_to_subsys()` to return NULL and skip knode_class initialization. On device removal, `class_to_subsys()` returns non-NULL, and `device_del()` calls `klist_del()` on the uninitialized knode, triggering a NULL pointer dereference.