CVE-2026-53204

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in probe

rsu_send_msg() can return -ETIMEDOUT when

wait_for_completion_interruptible_timeout() fires while the SMC call is still

pending. In stratix10_rsu_probe(), the error paths for COMMAND_RSU_DCMF_VERSION,

COMMAND_RSU_DCMF_STATUS, COMMAND_RSU_MAX_RETRY and COMMAND_RSU_GET_SPT_TABLE

call stratix10_svc_free_channel() - which sets chan->scl to NULL - but then

fall through and queue the next request on the same channel. The next svc

kthread that runs will dereference pdata->chan->scl in its receive callback

path, triggering a NULL pointer dereference identical to the one fixed by

commit c45f7263100c ("firmware: stratix10-rsu: Fix NULL pointer dereference

when RSU is disabled") for the COMMAND_RSU_STATUS path.

Apply the same cleanup pattern to the remaining failure paths: remove the

async client, free the channel, and return early so no further message

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References