PT-2026-52300 · Linux · Linux
Published
2026-06-25
·
Updated
2026-06-25
·
CVE-2026-53204
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
firmware: stratix10-rsu: Fix NULL deref on rsu send msg() timeout in probe
rsu send msg() can return -ETIMEDOUT when
wait for completion interruptible timeout() fires while the SMC call is still
pending. In stratix10 rsu probe(), the error paths for COMMAND RSU DCMF VERSION,
COMMAND RSU DCMF STATUS, COMMAND RSU MAX RETRY and COMMAND RSU GET SPT TABLE
call stratix10 svc free channel() - which sets chan->scl to NULL - but then
fall through and queue the next request on the same channel. The next svc
kthread that runs will dereference pdata->chan->scl in its receive callback
path, triggering a NULL pointer dereference identical to the one fixed by
commit c45f7263100c ("firmware: stratix10-rsu: Fix NULL pointer dereference
when RSU is disabled") for the COMMAND RSU STATUS path.
Apply the same cleanup pattern to the remaining failure paths: remove the
async client, free the channel, and return early so no further messages are
queued on a channel whose scl has been cleared.
While at it, clean up stratix10 rsu probe() in two ways without changing
behavior:
-
Drop redundant zero-initialization of fields already cleared by devm kzalloc(): client.receive cb, status.* and spt0/1 address (INVALID SPT ADDRESS is 0x0).
-
Replace five identical 3-line error-cleanup blocks (stratix10 svc remove async client() + stratix10 svc free channel() + return ret) with goto labels (remove async client, free channel), matching the standard kernel resource-unwinding pattern and making it easier to extend the probe sequence without forgetting matching cleanup.
Also move init completion() next to mutex init() so sync-primitive
initialization is grouped before anything that could trigger a
callback.
v2: Add a minor clean-up of the function stratix10 rsu probe() to have a
centralize exit for all the rsu send async msg() and rsu send msg().
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux