Executive brief
A vulnerability in the Linux kernel's support for Intel Stratix 10 processors can cause a system crash (kernel panic). This occurs when the Remote System Update (RSU) feature is disabled in the hardware's boot loader but the operating system still attempts to initialize the driver. An attacker with local access could potentially exploit this to cause a denial-of-service, impacting system availability and ongoing operations.
Technical details
A NULL pointer dereference exists in the drivers/firmware/stratix10-rsu.c component of the Linux kernel. When the Remote System Update (RSU) is not enabled in the First Stage Boot Loader (FSBL), the rsu_send_async_msg() function fails, leading to the service channel being freed. However, the probe function incorrectly continues execution and registers the svc_normal_to_secure_thread() thread, which then attempts to access the freed channel. This results in a kernel panic. The issue has been resolved by ensuring the driver returns an error and cleans up the async client immediately upon failure during the probe process.
Affected products
- Linux Linux Kernel 6.19 through 6.19.8
Timeline
- 2026-02-12: other: Patch authored
- 2026-05-08: disclosed: CVE published by kernel.org
- 2026-05-08: advisory
- 2026-03-19: patched: Patch committed to stable tree