CVE-2026-43410: firmware: stratix10-rsu: Fix NULL pointer dereference when RSU is disabled
In the Linux kernel, the following vulnerability has been resolved:
firmware: stratix10-rsu: Fix NULL pointer dereference when RSU is disabled
When the Remote System Update (RSU) isn't enabled in the First Stage Boot Loader (FSBL), the driver encounters a NULL pointer dereference when excute svcnormaltosecurethread() thread, resulting in a kernel panic:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 Mem abort info: ... Data abort info: ... [0000000000000008] user address but activemm is swapper Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 0 UID: 0 PID: 79 Comm: svcsmchvcthr Not tainted 6.19.0-rc8-yocto-standard+ #59 PREEMPT Hardware name: SoCFPGA Stratix 10 SoCDK (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : svcnormaltosecurethread+0x38c/0x990 lr : svcnormaltosecurethread+0x144/0x990 ... Call trace: svcnormaltosecurethread+0x38c/0x990 (P) kthread+0x150/0x210 retfromfork+0x10/0x20 Code: 97cfc113 f9400260 aa1403e1 f9400400 (f9400402) ---[ end trace 0000000000000000 ]---
The issue occurs because rsusendasyncmsg() fails when RSU is not enabled in firmware, causing the channel to be freed via stratix10svcfreechannel(). However, the probe function continues execution and registers svcnormaltosecurethread(), which subsequently attempts to access the already-freed channel, triggering the NULL pointer dereference.
Fix this by properly cleaning up the async client and returning early on failure, preventing the thread from being used with an invalid channel.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.19.10-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.4-1 - Compensating control
In the firmware: stratix10-rsu driver, properly clean up the async client and return early when rsu_send_async_msg() fails because RSU is disabled, preventing registration or use of svc_normal_to_secure_thread() with an invalid or freed channel.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects Linux systems using the Stratix 10 RSU driver on SoCFPGA Stratix 10 hardware when Remote System Update is not enabled in the First Stage Boot Loader.
What is required to trigger the kernel panic?
An attacker needs local access and low privileges. The failure occurs when the driver attempts to send an asynchronous RSU message even though RSU is disabled in firmware, leading to a NULL pointer dereference in a kernel thread.
What is the operational impact?
Successful triggering causes a kernel NULL pointer dereference and kernel panic, resulting in denial of service. The provided severity vector indicates no confidentiality or integrity impact.