CVE-2026-53204: Linux Kernel Stratix10 RSU NULL Pointer Dereference DoS

Technical summary

CVE-2026-53204 is a NULL pointer dereference (CWE-476) in the stratix10_rsu_probe() function of the Linux kernel firmware driver. The vulnerability occurs when rsu_send_msg() times out during initialization—specifically in error paths for COMMAND_RSU_DCMF_VERSION, COMMAND_RSU_DCMF_STATUS, COMMAND_RSU_MAX_RETRY, or COMMAND_RSU_GET_SPT_TABLE commands. The probe function calls stratix10_svc_free_channel(), which nullifies the channel's scl (service channel layer) pointer, but execution continues and queues subsequent requests on the now-invalid channel. When the svc kthread's receive callback attempts to dereference pdata->chan->scl, a NULL pointer dereference occurs. The fix applies proper error-unwinding logic with early returns, matching the pattern previously applied to the COMMAND_RSU_STATUS path in commit c45f7263100c.

Business impact

This vulnerability enables local denial of service on systems running the affected Linux kernel versions with Stratix10 hardware. An unprivileged local user can trigger a kernel panic by inducing firmware initialization timeouts, disrupting system availability. The impact is limited to systems with Intel Stratix10 FPGA/SoC hardware; general-purpose servers and client systems are unaffected. The attack requires local access and cannot be exploited remotely.

Affected systems

The Linux kernel is affected across multiple versions. Impact is specific to systems with Intel Stratix10 hardware (FPGA or SoC platforms). General-purpose Linux distributions and servers without Stratix10 devices are not vulnerable. Users must check their kernel version against the upstream fix and confirm whether their systems include Stratix10 hardware.

Exploitability

Exploitability is local-only, requiring existing user-level access (PR:L in CVSS). No authentication bypass or privilege escalation occurs. An attacker with shell access can trigger the vulnerable code path by inducing initialization timeouts on the RSU driver, causing a kernel panic. The attack is not complex (AC:L) and does not require user interaction. The vulnerability is difficult to exploit reliably in production due to the need to trigger specific timing conditions during driver probe.

Remediation

Apply the upstream kernel patch that introduces proper error handling with early returns and goto-based resource cleanup in stratix10_rsu_probe(). The fix prevents further message queueing after the channel is freed by returning early from error paths instead of falling through. Additionally, the patch refactors redundant initialization code and groups synchronization primitive initialization before any callback-triggering code. Verify the patch against your kernel version's upstream repository.

Patch guidance

Identify your running kernel version using 'uname -r'. Check the Linux kernel's upstream repository for commits addressing CVE-2026-53204 in the stratix10-rsu driver (firmware/stratix10-rsu.c). Apply the patch as part of a kernel update; do not attempt manual patching unless you are experienced with kernel compilation. Test thoroughly in a non-production environment before deploying to Stratix10-based systems. Coordinate patching with your firmware and FPGA stack updates to ensure compatibility.

Detection guidance

Monitor kernel logs (dmesg, journalctl) for NULL pointer dereference panics originating from the stratix10-rsu driver, particularly messages referencing 'scl' or the probe function. Watch for repeated system crashes during or shortly after boot on Stratix10 systems. Enable CONFIG_DEBUG_PAGEALLOC and CONFIG_KASAN in kernel builds to increase NULL dereference detection sensitivity. Systems without Stratix10 hardware will not trigger this code path and require no special monitoring.

Why prioritize this

Although rated MEDIUM (CVSS 5.5) due to local-only access requirements and lack of confidentiality/integrity impact, prioritization depends on your environment. If you operate Stratix10-based infrastructure (edge computing, FPGA acceleration platforms, aerospace/defense systems), treat this as HIGH priority for rapid kernel patching to prevent operational downtime. If you run only general-purpose infrastructure, this is a lower-priority background fix bundled into routine kernel updates.

Risk score, explained

The CVSS 3.1 score of 5.5 MEDIUM reflects: (1) Local attack vector (AV:L)—requires shell access; (2) Low attack complexity (AC:L)—no special conditions needed beyond local access; (3) Low privileges (PR:L)—unprivileged user account suffices; (4) No user interaction (UI:N); (5) Unavailability impact only (A:H)—kernel crash disrupts availability; (6) No confidentiality or integrity impact. The score appropriately penalizes the remote-attack vector but acknowledges the DoS severity.

Frequently asked questions