Executive brief
A vulnerability in the Linux kernel's Rockchip MMC driver could cause older hardware (RK2928, RK3066, RK3188) to crash. This occurs because recent updates to the driver expect certain data structures to exist that were not present in older controller versions. An exploit would result in a system crash (denial of service), potentially disrupting operations on devices using these specific older chips.
Technical details
A NULL pointer dereference exists in the dw_mmc-rockchip driver within the Linux kernel. The issue was introduced by a change that made driver private data mandatory for clock auto-gating support; however, older Rockchip controllers (RK2928, RK3066, RK3188) do not initialize this private data because they lack UHS speed support and the associated parse_dt callback. When the driver's init function attempts to access this uninitialized private data to check phase configurations, it triggers a kernel panic. This is a local denial-of-service vulnerability affecting specific older ARM-based hardware. Patches have been released across various stable kernel branches to ensure private data is correctly allocated for these older controller types.
Affected products
- Linux Linux 6.12.78 to 6.12.94, 6.18.19 to 6.18.36, 6.19, 7.0.13, 7.1
Timeline
- 2026-05-22: other: Patch authored
- 2026-06-25: disclosed: CVE published