HOMEVULNERABILITIESCVE-2026-53152
NONE

CVE-2026-53152

Published: June 25, 2026· Updated: Jun 30, 2026

EPSS:0.17%probability of exploitation in 30 daysPercentile:6.4th

Official Description

In the Linux kernel, the following vulnerability has been resolved:

mmc: dw_mmc-rockchip: Add missing private data for very old controllers

The really old controllers (rk2928, rk3066, rk3188) do not support UHS

speeds at all, and thus never handled phase data.

For that reason it never had a parse_dt callback and no driver private

data at all.

Commit ff6f0286c896 ("mmc: dw_mmc-rockchip: Add memory clock auto-gating

support") makes the private data sort of mandatory, because the init

function checks whether phases are configured internally or through the

clock controller.

This results in the old SoCs then experiencing NULL-pointer dereferences

when they try to access that private-data struct.

While we could have if (priv) conditionals in all places, it's way less

cluttery to just give the old types their private-data struct.

NVD Source

Technical Analysis

CVE-2026-53152 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

Affected Vendors & Products

Mentioned vendors (from description):
Linux
CPE data not yet available in NVD for this CVE.

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time
External links open in a new tab. Always verify in a controlled environment before use.

All References (4)

Quick Facts

CVE IDCVE-2026-53152
SeverityNONE
CISA KEVNo
EPSS (30d)0.17%
PublishedJun 25, 2026

Recommended Actions

  • Apply vendor patches immediately
  • Monitor CVE-2026-53152 in threat intel feeds
  • Review IDS/IPS signatures for exploitation attempts
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.