VYPR
Unrated severityNVD Advisory· Published Jun 24, 2026

fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal

CVE-2026-53042

Description

In the Linux kernel, the following vulnerability has been resolved:

fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal

CXL is linked before fwctl in drivers/Makefile. Both use module_init, so cxl_pci_driver_init() runs first. When cxl_pci_probe() calls fwctl_register() and then device_add(), fwctl_class is not yet registered because fwctl_init() hasn't run, causing class_to_subsys()` to return NULL and skip knode_class initialization.

On device removal, class_to_subsys() returns non-NULL, and device_del() calls klist_del() on the uninitialized knode, triggering a NULL pointer dereference.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

1

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.