In the Linux kernel, the following vulnerability has been resolved: fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal CXL is linked before fwctl in drivers/Makefile. Both use `module_init, so `cxl_pci_driver_init()` runs first. When `cxl_pci_probe()` calls `fwctl_register()` and then `device_add()`, fwctl_class is not yet registered because fwctl_init() hasn't run, causing `class_to_subsys()` to return NULL and skip knode_class initialization. On device removal, `class_to_subsys()` returns non-NULL, and `device_del()` calls `klist_del()` on the uninitialized knode, triggering a NULL pointer dereference.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: fwctl: Fix class init ordering to
    avoid NULL pointer dereference on device removal CXL is linked before fwctl in drivers/Makefile. Both use
    `module_init, so `cxl_pci_driver_init()` runs first. When `cxl_pci_probe()` calls `fwctl_register()` and
    then `device_add()`, fwctl_class is not yet registered because fwctl_init() hasn't run, causing
    `class_to_subsys()` to return NULL and skip knode_class initialization. On device removal,
    `class_to_subsys()` returns non-NULL, and `device_del()` calls `klist_del()` on the uninitialized knode,
    triggering a NULL pointer dereference. (CVE-2026-53042)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal CXL is linked before     fwctl in drivers/Makefile. Both use `module_init, so `cxl_pci_driver_init()` runs first. When     `cxl_pci_probe()` calls `fwctl_register()` and then `device_add()`, fwctl_class is not yet registered     because fwctl_init() hasn't run, causing `class_to_subsys()` to return NULL and skip knode_class     initialization. On device removal, `class_to_subsys()` returns non-NULL, and `device_del()` calls     `klist_del()` on the uninitialized knode, triggering a NULL pointer dereference. (CVE-2026-53042)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
471043	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 19862.0.0	Tenable Cloud Security	Google COS Security Checks	Local	medium
471043	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 19862.0.0	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
343532	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8728-1)	Nessus	Ubuntu Local Security Checks	Local	high
340681	Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)	Nessus	Ubuntu Local Security Checks	Local	high
323465	Linux Distros Unpatched Vulnerability : CVE-2026-53042	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-53042

medium

Tenable Plugins

medium

medium

high

high

medium