CyberSecBulletin
CVE-2026-53242NVD status: Modified

Linux: NULL Pointer Dereference

Published Updated By the CyberSecBulletin desk

CVE-2026-53242 is a high-severity NULL pointer dereference vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions cac5bf3500ee6422cf64e0df0b5daeecfed42917, 06eca2235a3fd281dddf25b0a97772b25b5bb573, d842f26a167e77a36f3ed333b9fa99d36ef99fe6 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.1% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to cac5bf3500ee6422cf64e0df0b5daeecfed42917 or 06eca2235a3fd281dddf25b0a97772b25b5bb573 or d842f26a167e77a36f3ed333b9fa99d36ef99fe6 or d68b621bb5a48051932f1017a6e1bc9b18f854d0, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.259 or 6.1.176 or 6.6.143 or 6.12.94, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux9baee36e8c5443411c4629afabafaff8a46a23fd up to, but not including, cac5bf3500ee6422cf64e0df0b5daeecfed42917; f2cb2e0d27fb925c73a78f0ce7d6dbf68d3747c1 up to, but not including, 06eca2235a3fd281dddf25b0a97772b25b5bb573; fc71f888994569f87d5bee20b1ac6c9c1e3a7a79 up to, but not including, d842f26a167e77a36f3ed333b9fa99d36ef99fe6; 629cf09464cf98670996ea5c191dc9743e6f3f00 up to, but not including, d68b621bb5a48051932f1017a6e1bc9b18f854d0; ae8f8d30d334bad5b1b3cdb1eb8a0b771f55e432 up to, but not including, b053fcd8912f06c30f932f5b8ec41c72de474695; 4a758e9a1f5ed722f83c4dd35f867fe811553bcb up to, but not including, cd98837db15f323463b8df07282ac723bd5c3fed; 9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6 up to, but not including, 7c71a9522555ff137a9ca36b15d759ca04d84788; 9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6 up to, but not including, 88fe2e3658726cb21ff2dcf9770bf672f9b9d31b; and 8 more rangescac5bf3500ee6422cf64e0df0b5daeecfed42917, 06eca2235a3fd281dddf25b0a97772b25b5bb573, d842f26a167e77a36f3ed333b9fa99d36ef99fe6, d68b621bb5a48051932f1017a6e1bc9b18f854d0, b053fcd8912f06c30f932f5b8ec41c72de474695, cd98837db15f323463b8df07282ac723bd5c3fed
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystemall versionsNot stated
LinuxLinux Kernel5.10.253 up to, but not including, 5.10.259; 6.1.167 up to, but not including, 6.1.176; 6.6.130 up to, but not including, 6.6.143; 6.12.78 up to, but not including, 6.12.94; 6.18.19 up to, but not including, 6.18.36; 6.19.9 up to, but not including, 7.0; 7.0.1 up to, but not including, 7.0.13; 7.0; and 1 more ranges5.10.259, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams snd_pcm_drain() uses init_waitqueue_entry which does not clear entry.prev/next, and add_wait_queue with a conditional remove_wait_queue that is skipped when to_check is no longer in the group after concurrent UNLINK. The orphaned wait entry remains on the unlinked substream sleep queue. On the next drain iteration, add_wait_queue adds the entry to a new queue while still linked on the old one, corrupting both lists. A subsequent wake_up dereferences NULL at the func pointer (mapped from the spinlock at offset 0 of the misinterpreted wait_queue_head_t), causing a kernel panic. Replace init_waitqueue_entry/add_wait_queue/conditional remove_wait_queue with init_wait_entry/prepare_to_wait/ finish_wait. init_wait_entry clears prev/next via INIT_LIST_HEAD on each iteration and sets autoremove_wake_function which auto-removes the entry on wake-up. finish_wait safely handles both the already-removed and still-queued cases.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

How developers prevent this class of flaw

  • For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished.
  • Select a programming language that is not susceptible to these issues.
  • Check the results of all functions that return a value and verify that the value is non-null before acting upon it.

More NULL Pointer Dereference vulnerabilities (CWE-476)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent NULL Pointer Dereference vulnerabilities

Spotted an error? Tell us.