Bug 2468176 (CVE-2026-43410) - CVE-2026-43410 kernel: firmware: stratix10-rsu: Fix NULL pointer dereference when RSU is disabled
Summary: CVE-2026-43410 kernel: firmware: stratix10-rsu: Fix NULL pointer dereference ...
Keywords:
Status: NEW
Alias: CVE-2026-43410
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-05-08 15:03 UTC by OSIDB Bzimport
Modified: 2026-05-08 22:39 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-05-08 15:03:07 UTC
In the Linux kernel, the following vulnerability has been resolved:

firmware: stratix10-rsu: Fix NULL pointer dereference when RSU is disabled

When the Remote System Update (RSU) isn't enabled in the First Stage
Boot Loader (FSBL), the driver encounters a NULL pointer dereference when
excute svc_normal_to_secure_thread() thread, resulting in a kernel panic:

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008
Mem abort info:
...
Data abort info:
...
[0000000000000008] user address but active_mm is swapper
Internal error: Oops: 0000000096000004 [#1]  SMP
Modules linked in:
CPU: 0 UID: 0 PID: 79 Comm: svc_smc_hvc_thr Not tainted 6.19.0-rc8-yocto-standard+ #59 PREEMPT
Hardware name: SoCFPGA Stratix 10 SoCDK (DT)
pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : svc_normal_to_secure_thread+0x38c/0x990
lr : svc_normal_to_secure_thread+0x144/0x990
...
Call trace:
 svc_normal_to_secure_thread+0x38c/0x990 (P)
 kthread+0x150/0x210
 ret_from_fork+0x10/0x20
Code: 97cfc113 f9400260 aa1403e1 f9400400 (f9400402)
---[ end trace 0000000000000000 ]---

The issue occurs because rsu_send_async_msg() fails when RSU is not enabled
in firmware, causing the channel to be freed via stratix10_svc_free_channel().
However, the probe function continues execution and registers
svc_normal_to_secure_thread(), which subsequently attempts to access the
already-freed channel, triggering the NULL pointer dereference.

Fix this by properly cleaning up the async client and returning early on
failure, preventing the thread from being used with an invalid channel.


Note You need to log in before you can comment on or make changes to this bug.