NULL Pointer Dereference in Qualcomm CCI Controller for Linux Kernel

CVE-2026-53339

What is CVE-2026-53339?

A vulnerability exists within the Linux kernel affecting the Qualcomm CCI controller, which manages I2C masters on modern platforms. If only one I2C master is initialized on certain boards, attempts to unbind the device or remove the driver can result in a NULL pointer dereference. Specifically, when calling cci_halt() for both masters, only one has an initialized completion, leading to potential system instability and crashes if the driver is unloaded improperly.

References