CVE-2026-53338

Source
https://cve.org/CVERecord?id=CVE-2026-53338
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53338.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-53338
Downstream
Published
2026-07-01T13:32:21.147Z
Modified
2026-07-08T08:13:43.765557219Z
Summary
net: airoha: Add NULL check for of_reserved_mem_lookup() in airoha_qdma_init_hfwd_queues()
Details

In the Linux kernel, the following vulnerability has been resolved:

net: airoha: Add NULL check for ofreservedmemlookup() in airohaqdmainithfwd_queues()

ofreservedmem_lookup() may return NULL if the reserved memory region referenced by the "memory-region" phandle is not found in the reserved memory table (e.g. due to a misconfigured DTS or a removed memory-region node). The current code dereferences the returned pointer without checking for NULL, leading to a kernel NULL pointer dereference at the following lines:

dma_addr = rmem->base;                          // line 1156
num_desc = div_u64(rmem->size, buf_size);       // line 1160

Add a NULL check after ofreservedmemlookup() and return -ENODEV if the lookup fails, which is consistent with the existing error handling for ofparse_phandle() failure in the same code block.

Database specific
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53338.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
3a1ce9e3d01bbf3912c3e3f81cb554d558eb715b
Fixed
01f7d4b504580664d36faea5671cde5e3f0d8a5b
Fixed
cdb96c42db7b256348f9b57718debfaa4bca6b39
Fixed
f9f25118faa4dd2b6e3d14a03d123bbdbd59925d

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53338.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.16.0
Fixed
6.18.36
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.0.13

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53338.json"