Executive brief
A vulnerability was identified in the Linux kernel's Stratix10 Remote System Update (RSU) driver. This driver is responsible for managing firmware updates on Intel Stratix 10 FPGAs. An error in how the system handles communication timeouts could lead to a system crash (NULL pointer dereference), potentially causing a denial of service for the affected hardware.
Technical details
A NULL pointer dereference exists in drivers/firmware/stratix10-rsu.c within the stratix10_rsu_probe() function. When rsu_send_msg() returns a timeout error (-ETIMEDOUT), the error handling path calls stratix10_svc_free_channel(), which sets the channel pointer (chan->scl) to NULL. However, the code incorrectly falls through to subsequent requests on the same channel. When the service kthread later attempts to execute a receive callback, it dereferences the now-NULL pointer, causing a kernel oops. The fix implements proper resource unwinding using goto labels to ensure the probe sequence terminates immediately upon failure.
Affected products
- Linux Linux Kernel 6.19, 7.0.13
Timeline
- 2026-05-20: other: Patch authored
- 2026-06-19: patched: Patch committed to stable tree
- 2026-06-25: disclosed: CVE published