CVE-2026-53204 Overview
CVE-2026-53204 is a NULL pointer dereference vulnerability in the Linux kernel's stratix10-rsu firmware driver. The flaw resides in the stratix10_rsu_probe() function, where multiple error paths free the service channel but continue queuing requests on the same channel. When rsu_send_msg() returns -ETIMEDOUT because wait_for_completion_interruptible_timeout() fires while an SMC call remains pending, subsequent service kthreads dereference a cleared pdata->chan->scl pointer. The defect mirrors the issue previously fixed by commit c45f7263100c for the COMMAND_RSU_STATUS path but persists across COMMAND_RSU_DCMF_VERSION, COMMAND_RSU_DCMF_STATUS, COMMAND_RSU_MAX_RETRY, and COMMAND_RSU_GET_SPT_TABLE paths.
Critical Impact
Triggering the probe-time timeout condition results in a kernel NULL pointer dereference, producing a kernel oops and denial of service on affected Intel Stratix 10 platforms.
Affected Products
- Linux kernel firmware/stratix10-rsu driver
- Intel Stratix 10 SoC FPGA platforms using the Remote System Update (RSU) firmware interface
- Kernel builds prior to the commits referenced in the upstream stable tree
Discovery Timeline
- 2026-06-25 - CVE-2026-53204 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-53204
Vulnerability Analysis
The stratix10-rsu driver coordinates Remote System Update operations between the Linux kernel and platform firmware through Secure Monitor Call (SMC) requests. During driver probe, stratix10_rsu_probe() issues a sequence of synchronous commands using rsu_send_msg() to query firmware metadata such as DCMF version, DCMF status, maximum retry count, and the Sub-Partition Table (SPT).
When any of these calls time out, the original error-handling code invoked stratix10_svc_free_channel(), which sets chan->scl to NULL. Execution then fell through to the next command on the same channel. The service kthread processing the next request dereferenced the cleared scl pointer in its receive callback path, producing a kernel oops.
Root Cause
The root cause is incorrect error-path control flow in stratix10_rsu_probe(). Four command paths released channel resources but failed to abort the probe, allowing later messages to be queued on a torn-down channel. The fix applies the cleanup pattern already used for COMMAND_RSU_STATUS: remove the async client, free the channel, and return early. The patch also refactors five identical cleanup blocks into goto labels (remove_async_client, free_channel) and relocates init_completion() next to mutex_init() so synchronization primitives are initialized before any callback can fire.
Attack Vector
The vulnerability is reachable only during driver probe on affected Stratix 10 hardware when firmware SMC calls time out. It is a reliability and stability defect rather than a remotely exploitable flaw. An attacker with the ability to influence firmware response timing on the platform could induce the kernel oops, resulting in denial of service. No code execution primitive has been demonstrated from this NULL dereference.
The vulnerability mechanism is described in the upstream commits. See the Kernel Git Commit Update and Kernel Git Commit Change for the full patch context.
Detection Methods for CVE-2026-53204
Indicators of Compromise
- Kernel oops messages referencing stratix10_rsu or stratix10_svc in the receive callback path
- BUG: kernel NULL pointer dereference entries in dmesg originating from rsu_send_msg() or service kthread context during boot
- Probe-time errors from stratix10_rsu followed by an immediate kernel fault on Stratix 10 SoC FPGA hardware
Detection Strategies
- Audit kernel package versions across Linux fleets that include Intel Stratix 10 platforms and compare against the patched stable tree commits
- Parse boot logs and kdump crash artifacts for stack traces referencing stratix10_svc_free_channel and subsequent NULL dereferences
- Track kernel panic telemetry from embedded and SoC FPGA systems where firmware timing variability is common
Monitoring Recommendations
- Forward dmesg, journald, and kdump outputs to a centralized log platform for kernel oops correlation
- Alert on repeated probe failures of the stratix10-rsu driver across managed hosts
- Monitor stable kernel advisories for additional backports affecting the Stratix 10 firmware driver
How to Mitigate CVE-2026-53204
Immediate Actions Required
- Apply the upstream kernel patches referenced by commits 6bc249d32424 and bfd2eb9bba54 to all affected builds
- Rebuild and redeploy custom kernels used on Intel Stratix 10 SoC FPGA platforms
- Validate driver probe behavior under firmware timeout conditions in test environments before production rollout
Patch Information
The fix is published in the Linux stable tree. Refer to the Kernel Git Commit Update and the Kernel Git Commit Change for the complete patch set. The patches add early returns to the affected error paths, consolidate cleanup with goto labels, and reorder completion initialization to prevent callbacks against uninitialized state.
Workarounds
- Disable or blacklist the stratix10-rsu kernel module on systems that do not require Remote System Update functionality
- Avoid enabling the driver in kernel builds for hardware platforms that do not include Stratix 10 SoC FPGA components
- Where feasible, increase firmware responsiveness or reduce contention to lower the probability of probe-time SMC timeouts until patches are deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
