Unrated severityNVD Advisory· Published Jun 24, 2026
fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal
CVE-2026-53042
Description
In the Linux kernel, the following vulnerability has been resolved:
fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal
CXL is linked before fwctl in drivers/Makefile. Both use module_init, so cxl_pci_driver_init() runs first. When cxl_pci_probe() calls fwctl_register() and then device_add(), fwctl_class is not yet registered because fwctl_init() hasn't run, causing class_to_subsys()` to return NULL and skip knode_class initialization.
On device removal, class_to_subsys() returns non-NULL, and device_del() calls klist_del() on the uninitialized knode, triggering a NULL pointer dereference.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.