---
id: CVE-2026-53152
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mmc: dw_mmc-rockchip: Add missing private data for very old controllers

  The really old controllers (rk2928, rk3066, rk3188) do not support UHS
  speeds at all, and thus …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mmc: dw_mmc-rockchip: Add missing private data for very old controllers

  The really old controllers (rk2928, rk3066, rk3188) do not support UHS
  speeds at all, and thus …
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-476
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 6.12.78, < 6.12.94'
  - 'linux_kernel >= 6.18.19, < 6.18.36'
  - 'linux_kernel >= 6.19, < 7.0.13'
  - linux_kernel = 7.1
patched:
  - linux_kernel 7.0.13
published: '2026-06-25'
updated: '2026-07-06'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53152'
references:
  - url: 'https://git.kernel.org/stable/c/1e9a4850afa0ceb63984fb1a9f3e86d0fc4fd18f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7f8007be13e6cc1e0a508fe461f9a91ba9a28b8c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8d9eca906e76d3dd40e5f2c79701f066678f2e62'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b1180ff50cca48807893ecde7d1f81d573c88c85'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00162
epssPercentile: 0.05794
ingestedAt: '2026-07-06T17:44:51.353Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mmc: dw_mmc-rockchip: Add missing private data for very old controllers

The really old controllers (rk2928, rk3066, rk3188) do not support UHS
speeds at all, and thus never handled phase data.

For that reason it never had a parse_dt callback and no driver private
data at all.

Commit ff6f0286c896 ("mmc: dw_mmc-rockchip: Add memory clock auto-gating
support") makes the private data sort of mandatory, because the init
function checks whether phases are configured internally or through the
clock controller.

This results in the old SoCs then experiencing NULL-pointer dereferences
when they try to access that private-data struct.

While we could have if (priv) conditionals in all places, it's way less
cluttery to just give the old types their private-data struct.

## Affected

- `linux_kernel >= 6.12.78, < 6.12.94`
- `linux_kernel >= 6.18.19, < 6.18.36`
- `linux_kernel >= 6.19, < 7.0.13`
- `linux_kernel = 7.1`

## Remediation

Upgrade past the affected range:

- `linux_kernel 7.0.13`