# CVE-2026-53204: linux: In the Linux kernel, the following vulnerability has been resolved:  firmware: stratix10-rsu: Fix NULL deref on rsu_s...

CVE-2026-53204 is fixed in linux on 1 platform by DEBIAN-CVE-2026-53204 (version 7.0.13-1), released June 28, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-53204
- Priority: Routine
- CVSS: 5.5 (medium)
- EPSS: 0.0014
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jun 25, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in probe  rsu_send_msg() can return -ETIMEDOUT when wait_for_completion_interruptible_timeout() fires while the SMC call is still pending. In stratix10_rsu_probe(), the error paths for COMMAND_RSU_DCMF_VERSION, COMMAND_RSU_DCMF_STATUS, COMMAND_RSU_MAX_RETRY and COMMAND_RSU_GET_SPT_TABLE call stratix10_svc_free_channel() - which sets chan->scl to NULL - but then fall through and queue the next request on the same channel. The next svc kthread that runs will dereference pdata->chan->scl in its receive callback path, triggering a NULL pointer dereference identical to the one fixed by commit c45f7263100c ("firmware: stratix10-rsu: Fix NULL pointer dereference when RSU is disabled") for the COMMAND_RSU_STATUS path.  Apply the same cleanup pattern to the remaining failure paths: remove the async client, free the channel, and return early so no further messages are queued on a channel whose scl has been cleared.  While at it, clean up stratix10_rsu_probe() in two ways without changing behavior:  - Drop redundant zero-initialization of fields already cleared by   devm_kzalloc(): client.receive_cb, status.* and spt0/1_address   (INVALID_SPT_ADDRESS is 0x0).  - Replace five identical 3-line error-cleanup blocks   (stratix10_svc_remove_async_client() + stratix10_svc_free_channel() +   return ret) with goto labels (remove_async_client, free_channel),   matching the standard kernel resource-unwinding pattern and making it   easier to extend the probe sequence without forgetting matching   cleanup.  Also move init_completion() next to mutex_init() so sync-primitive initialization is grouped before anything that could trigger a callback.  --- v2: Add a minor clean-up of the function stratix10_rsu_probe() to have a     centralize exit for all the rsu_send_async_msg() and rsu_send_msg().

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 7.0.13-1 | [DEBIAN-CVE-2026-53204](https://patchblox.com/security/data/fix/linux/debian-cve-2026-53204.md) | Jun 28, 2026 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.