CVE-2026-53042

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the fwctl component where incorrect class initialization ordering can lead to a NULL pointer dereference during device removal. Because CXL is linked before fwctl in the drivers Makefile, the cxl pci driver init() function executes first. When cxl pci probe() invokes fwctl register() and device add(), the fwctl class is not yet registered since fwctl init() has not run. This causes class to subsys() to return NULL, skipping the initialization of knode class. During subsequent device removal, class to subsys() returns a non-NULL value, and device del() attempts to call klist del() on the uninitialized knode, resulting in a NULL pointer dereference.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.