CVE-2026-53152
mmc: dw_mmc-rockchip: Add missing private data for very old controllers
Description
In the Linux kernel, the following vulnerability has been resolved: mmc: dw_mmc-rockchip: Add missing private data for very old controllers The really old controllers (rk2928, rk3066, rk3188) do not support UHS speeds at all, and thus never handled phase data. For that reason it never had a parse_dt callback and no driver private data at all. Commit ff6f0286c896 ("mmc: dw_mmc-rockchip: Add memory clock auto-gating support") makes the private data sort of mandatory, because the init function checks whether phases are configured internally or through the clock controller. This results in the old SoCs then experiencing NULL-pointer dereferences when they try to access that private-data struct. While we could have if (priv) conditionals in all places, it's way less cluttery to just give the old types their private-data struct.
INFO
Published Date :
June 25, 2026, 9:16 a.m.
Last Modified :
July 6, 2026, 5:39 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Update the Linux kernel to the latest stable version.
- Ensure private data structures are correctly initialized.
- Verify controller compatibility with UHS speeds.
- Test system stability after applying updates.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53152.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53152 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53152
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53152 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-53152 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jul. 06, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-476 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.13 *cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.12.78 up to (excluding) 6.12.94 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.18.19 up to (excluding) 6.18.36 Added Reference Type kernel.org: https://git.kernel.org/stable/c/1e9a4850afa0ceb63984fb1a9f3e86d0fc4fd18f Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/7f8007be13e6cc1e0a508fe461f9a91ba9a28b8c Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/8d9eca906e76d3dd40e5f2c79701f066678f2e62 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/b1180ff50cca48807893ecde7d1f81d573c88c85 Types: Patch -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 25, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '7457b35afafef5195a498d13b3e05f4258beeecc', 'lessThan': 'b1180ff50cca48807893ecde7d1f81d573c88c85', 'versionType': 'git'}, {'status': 'affected', 'version': '5b58ba042e2379f4c01da3211fd17dbdc983c2ac', 'lessThan': '7f8007be13e6cc1e0a508fe461f9a91ba9a28b8c', 'versionType': 'git'}, {'status': 'affected', 'version': 'ff6f0286c896f062853552097220dd93961be9c4', 'lessThan': '8d9eca906e76d3dd40e5f2c79701f066678f2e62', 'versionType': 'git'}, {'status': 'affected', 'version': 'ff6f0286c896f062853552097220dd93961be9c4', 'lessThan': '1e9a4850afa0ceb63984fb1a9f3e86d0fc4fd18f', 'versionType': 'git'}, {'status': 'affected', 'version': '6.12.78', 'lessThan': '6.12.94', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.18.19', 'lessThan': '6.18.36', 'versionType': 'semver'}], 'programFiles': ['drivers/mmc/host/dw_mmc-rockchip.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.19'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.19', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.12.94', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.36', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.13', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/mmc/host/dw_mmc-rockchip.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: mmc: dw_mmc-rockchip: Add missing private data for very old controllers The really old controllers (rk2928, rk3066, rk3188) do not support UHS speeds at all, and thus never handled phase data. For that reason it never had a parse_dt callback and no driver private data at all. Commit ff6f0286c896 ("mmc: dw_mmc-rockchip: Add memory clock auto-gating support") makes the private data sort of mandatory, because the init function checks whether phases are configured internally or through the clock controller. This results in the old SoCs then experiencing NULL-pointer dereferences when they try to access that private-data struct. While we could have if (priv) conditionals in all places, it's way less cluttery to just give the old types their private-data struct. Added Reference https://git.kernel.org/stable/c/1e9a4850afa0ceb63984fb1a9f3e86d0fc4fd18f Added Reference https://git.kernel.org/stable/c/7f8007be13e6cc1e0a508fe461f9a91ba9a28b8c Added Reference https://git.kernel.org/stable/c/8d9eca906e76d3dd40e5f2c79701f066678f2e62 Added Reference https://git.kernel.org/stable/c/b1180ff50cca48807893ecde7d1f81d573c88c85