Medium 5.5Published Jun 26, 2026

CVE-2026-53298net: airoha: Move ndesc initialization at end of airoha_qdma_init_rx_queue()

Updated under an hour ago (Oct 27, 2026, 7:10 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Move ndesc initialization at end of airoha_qdma_init_rx_queue() If queue entry or DMA descriptor list allocation fails in airoha_qdma_init_rx_queue routine, airoha_qdma_cleanup() will trigger a NULL pointer dereference running netif_napi_del() for RX queue NAPIs since netif_napi_add() has never been executed to this particular RX NAPI. The issue is due to the early ndesc initialization in airoha_qdma_init_rx_queue() since airoha_qdma_cleanup() relies on ndesc value to check if the queue is properly initialized. Fix the issue moving ndesc initialization at end of airoha_qdma_init_tx routine. Move page_pool allocation after descriptor list allocation in order to avoid memory leaks if desc allocation fails.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Jun 26, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 23020f04932701d5c8363e60756f12b43b8ed752 before d36be272adda7f313e39dd118086955d993bf6a7; 23020f04932701d5c8363e60756f12b43b8ed752 builds before 4d4acfa348a1d8c0941004823662ede0fdb5dea5; 23020f04932701d5c8363e60756f12b43b8ed752 builds before 14dc48e5ba73d5c69559bf1a1a6884f7843aade7; from 23020f04932701d5c8363e60756f12b43b8ed752 before 379050947a1828826ad7ea50c95245a56929b35a	CNA record
linux linux_kernel linux:linux_kernel	from 6.11 before 6.12.91; from 6.13 before 6.18.33; from 6.19 before 7.0.10	NVD

References

References

https://git.kernel.org/stable/c/d36be272adda7f313e39dd118086955d993bf6a7	patch
https://git.kernel.org/stable/c/4d4acfa348a1d8c0941004823662ede0fdb5dea5	patch
https://git.kernel.org/stable/c/14dc48e5ba73d5c69559bf1a1a6884f7843aade7	patch
https://git.kernel.org/stable/c/379050947a1828826ad7ea50c95245a56929b35a	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.