CVE-2026-53298

net: airoha: Move ndesc initialization at end of airoha_qdma_init_rx_queue()

State
Published
Severity
Not scored
Published
Jun 26, 2026
Updated
Jun 26, 2026
Reserved
Jun 9, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net: airoha: Move ndesc initialization at end of airoha_qdma_init_rx_queue()

If queue entry or DMA descriptor list allocation fails in airoha_qdma_init_rx_queue routine, airoha_qdma_cleanup() will trigger a NULL pointer dereference running netif_napi_del() for RX queue NAPIs since netif_napi_add() has never been executed to this particular RX NAPI. The issue is due to the early ndesc initialization in airoha_qdma_init_rx_queue() since airoha_qdma_cleanup() relies on ndesc value to check if the queue is properly initialized. Fix the issue moving ndesc initialization at end of airoha_qdma_init_tx routine. Move page_pool allocation after descriptor list allocation in order to avoid memory leaks if desc allocation fails.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 23020f04932701d5c8363e60756f12b43b8ed752 to before d36be272adda7f313e39dd118086955d993bf6a7Affected
  • 23020f04932701d5c8363e60756f12b43b8ed752 to before 4d4acfa348a1d8c0941004823662ede0fdb5dea5Affected
  • 23020f04932701d5c8363e60756f12b43b8ed752 to before 14dc48e5ba73d5c69559bf1a1a6884f7843aade7Affected
  • 23020f04932701d5c8363e60756f12b43b8ed752 to before 379050947a1828826ad7ea50c95245a56929b35aAffected
LinuxLinux
  • 6.11Affected
  • before 6.11Not affected
  • 6.12.91 through 6.12.*Not affected
  • 6.18.33 through 6.18.*Not affected
  • 7.0.10 through 7.0.*Not affected
  • 7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.