CyberSecBulletin
CVE-2026-53392NVD status: Modified

Linux: NULL Pointer Dereference

Published Updated By the CyberSecBulletin desk

CVE-2026-53392 is a high-severity NULL pointer dereference vulnerability in Linux, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 9033591535c066726f5b505126ccb4068b98fa4f, 18cc6d57a14fa65ab2a2b52279f549041c4bc9cf, be7829715e341b42846437dd9e721005db59f0cc as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.53% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 9033591535c066726f5b505126ccb4068b98fa4f or 18cc6d57a14fa65ab2a2b52279f549041c4bc9cf or be7829715e341b42846437dd9e721005db59f0cc or eeabb9020721db6bc132e68eeae380b8d4fb4b04, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.261 or 5.15.212 or 6.1.178 or 6.6.145, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxd67ae825a59d639e4d8b82413af84d854617a87e up to, but not including, 9033591535c066726f5b505126ccb4068b98fa4f; d67ae825a59d639e4d8b82413af84d854617a87e up to, but not including, 18cc6d57a14fa65ab2a2b52279f549041c4bc9cf; d67ae825a59d639e4d8b82413af84d854617a87e up to, but not including, be7829715e341b42846437dd9e721005db59f0cc; d67ae825a59d639e4d8b82413af84d854617a87e up to, but not including, eeabb9020721db6bc132e68eeae380b8d4fb4b04; d67ae825a59d639e4d8b82413af84d854617a87e up to, but not including, 7779c85028a0676fb190cde4f0c540f4f8e97761; d67ae825a59d639e4d8b82413af84d854617a87e up to, but not including, d8c90c7cc061265d5f2813a1f5c82ef2f4707e67; d67ae825a59d639e4d8b82413af84d854617a87e up to, but not including, 2131ed64b767ffa8bcdb3677d90f3964e39aabc8; d67ae825a59d639e4d8b82413af84d854617a87e up to, but not including, 2c6bb3c40bc24f6aa8dfbe6fe98c3ad6389203f2; and 1 more ranges9033591535c066726f5b505126ccb4068b98fa4f, 18cc6d57a14fa65ab2a2b52279f549041c4bc9cf, be7829715e341b42846437dd9e721005db59f0cc, eeabb9020721db6bc132e68eeae380b8d4fb4b04, 7779c85028a0676fb190cde4f0c540f4f8e97761, d8c90c7cc061265d5f2813a1f5c82ef2f4707e67
LinuxLinux Kernel4.0 up to, but not including, 5.10.261; 5.11 up to, but not including, 5.15.212; 5.16 up to, but not including, 6.1.178; 6.2 up to, but not including, 6.6.145; 6.7 up to, but not including, 6.12.96; 6.13 up to, but not including, 6.18.38; 6.19 up to, but not including, 7.1.35.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.38

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
NoneNo data is disclosed.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero filehandle version count ff_layout_alloc_lseg() decodes the filehandle-version array count from the flexfiles layout body. The value is used as the count for kzalloc_objs(), and the current code only rejects NULL. A zero count yields ZERO_SIZE_PTR, which can be stored in dss_info->fh_versions even though later flexfiles paths assume that at least one filehandle version exists. Reject fh_count == 0 before the allocation, matching the existing zero version_count validation in the flexfiles GETDEVICEINFO parser. A QEMU/KASAN run with a malformed flexfiles layout hit: KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:ff_layout_encode_ff_layoutupdate.isra.0+0x15f/0x750 ff_layout_encode_layoutreturn+0x683/0x970 nfs4_xdr_enc_layoutreturn+0x278/0x3a0 Kernel panic - not syncing: Fatal exception The patched kernel rejects the malformed layout without KASAN/oops/panic, and a valid fh_count=1 regression still opens, reads, and unmounts cleanly.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

How developers prevent this class of flaw

  • For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished.
  • Select a programming language that is not susceptible to these issues.
  • Check the results of all functions that return a value and verify that the value is non-null before acting upon it.

More NULL Pointer Dereference vulnerabilities (CWE-476)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent NULL Pointer Dereference vulnerabilities

Spotted an error? Tell us.