5.5

CVE-2026-53297: linux NULL Pointer Dereference

CVSS: 5.5v3.1MediumModified
AliasesUBUNTU-CVE-2026-53297DEBIAN-CVE-2026-53297CGA-3492-8qm2-7m5r
Published 26-06-2026Last modified 21-10-2026
Open JSON

Vulnerability summary

CVE-2026-53297 is a medium (CVSS 5.5) NULL Pointer Dereference vulnerability in linux. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 4.8% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.16%
0%100%
Low · +0.04 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 26 · Related 26
OPENSUSE-SU-2026:21555-1SUSE-SU-2026:23066-1SUSE-SU-2026:23068-1SUSE-SU-2026:23193-1SUSE-SU-2026:23194-1SUSE-SU-2026:23221-1

Timeline

  1. 26-06-2026
    PublishedVulnerability first disclosed.
  2. 21-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: net: mana: Guard mana_remove against double invocation If PM resume fails (e.g., mana_attach() returns an error), mana_probe() calls mana_remove(), which tears down the device and sets gd->gdma_context = NULL and gd->driver_data = NULL. However, a failed resume callback does not automatically unbind the driver. When the device is eventually unbound, mana_remove() is invoked a second time. Without a NULL check, it dereferences gc->dev with gc == NULL, causing a kernel panic. Add an early return if gdma_context or driver_data is NULL so the second invocation is harmless. Move the dev = gc->dev assignment after the guard so it cannot dereference NULL.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.16%

Chance of exploitation in the next 30 days

Percentile

5%

Versus all other CVEs

30-day change

+0.04 pp

From 0.12% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.16%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu143 products
  • linuxAll versions (No fix recorded) | < 7.0.0-28.28
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 7.0.0-1009.9
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Chainguard5 products
  • linux-aws-6.12All versions (No fix recorded)
  • linux-azure-6.12All versions (No fix recorded)
  • linux-gcp-6.12All versions (No fix recorded)
  • linux-qemu-6.12All versions (No fix recorded)
  • linux-vmware-6.12All versions (No fix recorded)
Linux2 products
  • linux≥ 635096a86edb067d55a1e04b4a918f5c6dac0c51, < 793bf1f4e469c51d0e39199823da5e1de85a2741 | ≥ 635096a86edb067d55a1e04b4a918f5c6dac0c51, < 8ee85b75a72216c857c39457f6595709c4c9f856 | ≥ 635096a86edb067d55a1e04b4a918f5c6dac0c51, < a1ddfd2c0b7a48e5239fadd2a24cc4bc2cda90e6 | ≥ 635096a86edb067d55a1e04b4a918f5c6dac0c51, < bbe5c3c570645a4ceb120979d3ee203a1583d775 | ≥ 635096a86edb067d55a1e04b4a918f5c6dac0c51, < 50271d7ec95144d26808025b508f463780517d3c | 5.16
  • linux_kernel≥ 5.16, < 6.18.33 | ≥ 6.19, < 7.0.10
Debian1 product
  • linuxAll versions (No fix recorded) | < 7.0.10-1

4 vendors · 151 products

References

20 links
Show all 20 references