CVE-2026-53332 (GCVE-0-2026-53332)

Vulnerability from cvelistv5 – Published: 2026-07-01 13:32 – Updated: 2026-07-01 13:32
VLAI
Title
slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd
Summary
In the Linux kernel, the following vulnerability has been resolved: slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd When the remoteproc starts in parallel with the NGD driver being probed, or the remoteproc is already up when the PDR lookup is being registered, or in the theoretical event that we get an interrupt from the hardware, these callbacks will operate on uninitialized data. This result in issues to boot the affected boards. One such example can be seen in the following fault, where qcom_slim_ngd_ssr_pdr_notify() schedules work on the NULL ngd_up_work. [ 21.858578] ------------[ cut here ]------------ [ 21.858745] WARNING: kernel/workqueue.c:2338 at __queue_work+0x5e0/0x790, CPU#2: kworker/2:2/116 ... [ 21.859251] Call trace: [ 21.859255] __queue_work+0x5e0/0x790 (P) [ 21.859265] queue_work_on+0x6c/0xf0 [ 21.859273] qcom_slim_ngd_ssr_pdr_notify+0x110/0x150 [slim_qcom_ngd_ctrl] [ 21.859304] qcom_slim_ngd_ssr_notify+0x24/0x40 [slim_qcom_ngd_ctrl] [ 21.859318] notifier_call_chain+0xa4/0x230 [ 21.859329] srcu_notifier_call_chain+0x64/0xb8 [ 21.859338] ssr_notify_start+0x40/0x78 [qcom_common] [ 21.859355] rproc_start+0x130/0x230 [ 21.859367] rproc_boot+0x3d4/0x518 ... Move the enablement of interrupts, and the registration of SSR and PDR until after the NGD device has been registered. This could be further refined by moving initialization to the control driver probe and by removing the platform driver model from the picture.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 917809e2280bb83994be8b642373fd941d40c407 , < fa3790c7ea98328ddc3f7d8bf40247556245a6fc (git)
Affected: 917809e2280bb83994be8b642373fd941d40c407 , < 24ec89123fc9d0d24ce719dcf7fd6c57e5b0d753 (git)
Affected: 917809e2280bb83994be8b642373fd941d40c407 , < 08564e15c47a5fb0af6643a43ee15521d49bcdea (git)
Affected: 917809e2280bb83994be8b642373fd941d40c407 , < 2a9d50e9ea406e0c8735938484adc20515ef1b47 (git)
Create a notification for this product.
Linux Linux Affected: 4.19
Unaffected: 0 , < 4.19 (semver)
Unaffected: 6.12.94 , ≤ 6.12.* (semver)
Unaffected: 6.18.36 , ≤ 6.18.* (semver)
Unaffected: 7.0.13 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/slimbus/qcom-ngd-ctrl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fa3790c7ea98328ddc3f7d8bf40247556245a6fc",
              "status": "affected",
              "version": "917809e2280bb83994be8b642373fd941d40c407",
              "versionType": "git"
            },
            {
              "lessThan": "24ec89123fc9d0d24ce719dcf7fd6c57e5b0d753",
              "status": "affected",
              "version": "917809e2280bb83994be8b642373fd941d40c407",
              "versionType": "git"
            },
            {
              "lessThan": "08564e15c47a5fb0af6643a43ee15521d49bcdea",
              "status": "affected",
              "version": "917809e2280bb83994be8b642373fd941d40c407",
              "versionType": "git"
            },
            {
              "lessThan": "2a9d50e9ea406e0c8735938484adc20515ef1b47",
              "status": "affected",
              "version": "917809e2280bb83994be8b642373fd941d40c407",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/slimbus/qcom-ngd-ctrl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nslimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd\n\nWhen the remoteproc starts in parallel with the NGD driver being probed,\nor the remoteproc is already up when the PDR lookup is being registered,\nor in the theoretical event that we get an interrupt from the hardware,\nthese callbacks will operate on uninitialized data. This result in\nissues to boot the affected boards.\n\nOne such example can be seen in the following fault, where\nqcom_slim_ngd_ssr_pdr_notify() schedules work on the NULL ngd_up_work.\n\n[   21.858578] ------------[ cut here ]------------\n[   21.858745] WARNING: kernel/workqueue.c:2338 at __queue_work+0x5e0/0x790, CPU#2: kworker/2:2/116\n...\n[   21.859251] Call trace:\n[   21.859255]  __queue_work+0x5e0/0x790 (P)\n[   21.859265]  queue_work_on+0x6c/0xf0\n[   21.859273]  qcom_slim_ngd_ssr_pdr_notify+0x110/0x150 [slim_qcom_ngd_ctrl]\n[   21.859304]  qcom_slim_ngd_ssr_notify+0x24/0x40 [slim_qcom_ngd_ctrl]\n[   21.859318]  notifier_call_chain+0xa4/0x230\n[   21.859329]  srcu_notifier_call_chain+0x64/0xb8\n[   21.859338]  ssr_notify_start+0x40/0x78 [qcom_common]\n[   21.859355]  rproc_start+0x130/0x230\n[   21.859367]  rproc_boot+0x3d4/0x518\n...\n\nMove the enablement of interrupts, and the registration of SSR and PDR\nuntil after the NGD device has been registered.\n\nThis could be further refined by moving initialization to the control\ndriver probe and by removing the platform driver model from the picture."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-01T13:32:16.289Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fa3790c7ea98328ddc3f7d8bf40247556245a6fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/24ec89123fc9d0d24ce719dcf7fd6c57e5b0d753"
        },
        {
          "url": "https://git.kernel.org/stable/c/08564e15c47a5fb0af6643a43ee15521d49bcdea"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a9d50e9ea406e0c8735938484adc20515ef1b47"
        }
      ],
      "title": "slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53332",
    "datePublished": "2026-07-01T13:32:16.289Z",
    "dateReserved": "2026-06-09T07:44:35.398Z",
    "dateUpdated": "2026-07-01T13:32:16.289Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-53332",
      "date": "2026-07-02",
      "epss": "0.00168",
      "percentile": "0.06375"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-53332\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-01T14:16:41.137\",\"lastModified\":\"2026-07-01T14:16:41.137\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nslimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd\\n\\nWhen the remoteproc starts in parallel with the NGD driver being probed,\\nor the remoteproc is already up when the PDR lookup is being registered,\\nor in the theoretical event that we get an interrupt from the hardware,\\nthese callbacks will operate on uninitialized data. This result in\\nissues to boot the affected boards.\\n\\nOne such example can be seen in the following fault, where\\nqcom_slim_ngd_ssr_pdr_notify() schedules work on the NULL ngd_up_work.\\n\\n[   21.858578] ------------[ cut here ]------------\\n[   21.858745] WARNING: kernel/workqueue.c:2338 at __queue_work+0x5e0/0x790, CPU#2: kworker/2:2/116\\n...\\n[   21.859251] Call trace:\\n[   21.859255]  __queue_work+0x5e0/0x790 (P)\\n[   21.859265]  queue_work_on+0x6c/0xf0\\n[   21.859273]  qcom_slim_ngd_ssr_pdr_notify+0x110/0x150 [slim_qcom_ngd_ctrl]\\n[   21.859304]  qcom_slim_ngd_ssr_notify+0x24/0x40 [slim_qcom_ngd_ctrl]\\n[   21.859318]  notifier_call_chain+0xa4/0x230\\n[   21.859329]  srcu_notifier_call_chain+0x64/0xb8\\n[   21.859338]  ssr_notify_start+0x40/0x78 [qcom_common]\\n[   21.859355]  rproc_start+0x130/0x230\\n[   21.859367]  rproc_boot+0x3d4/0x518\\n...\\n\\nMove the enablement of interrupts, and the registration of SSR and PDR\\nuntil after the NGD device has been registered.\\n\\nThis could be further refined by moving initialization to the control\\ndriver probe and by removing the platform driver model from the picture.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/slimbus/qcom-ngd-ctrl.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"917809e2280bb83994be8b642373fd941d40c407\",\"lessThan\":\"fa3790c7ea98328ddc3f7d8bf40247556245a6fc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"917809e2280bb83994be8b642373fd941d40c407\",\"lessThan\":\"24ec89123fc9d0d24ce719dcf7fd6c57e5b0d753\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"917809e2280bb83994be8b642373fd941d40c407\",\"lessThan\":\"08564e15c47a5fb0af6643a43ee15521d49bcdea\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"917809e2280bb83994be8b642373fd941d40c407\",\"lessThan\":\"2a9d50e9ea406e0c8735938484adc20515ef1b47\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/slimbus/qcom-ngd-ctrl.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.94\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.36\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.13\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/08564e15c47a5fb0af6643a43ee15521d49bcdea\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/24ec89123fc9d0d24ce719dcf7fd6c57e5b0d753\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2a9d50e9ea406e0c8735938484adc20515ef1b47\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fa3790c7ea98328ddc3f7d8bf40247556245a6fc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.