CVE-2026-43410

/* * PoC for CVE-2026-43410: Kernel NULL Pointer Dereference * Context: This vulnerability triggers during the driver probe phase * if RSU is disabled in FSBL. * * Note: This is a conceptual representation of the vulnerable logic. * Actual exploitation requires specific hardware (SoCFPGA Stratix 10) * and kernel configuration. */ #include <stdio.h> #include <stdlib.h> // Simulating the kernel channel structure struct svc_channel { void *data; }; // Simulating the vulnerable thread function void vulnerable_thread(struct svc_channel *chan) { printf("[+] Thread started, accessing channel..."); // The crash happens here because chan was freed but the thread still runs if (chan->data == 0x0) { // Simulating access at offset 0x00 or 0x08 printf("CRASH: NULL Pointer Dereference!\n"); // In real kernel: Oops: 0000000096000004 } } int main() { struct svc_channel *chan = malloc(sizeof(struct svc_channel)); chan->data = NULL; // Simulate Probe Failure printf("[*] Probe failed, freeing channel..."); free(chan); chan = NULL; // Logic bug: The cleanup didn't stop the thread registration // Simulate Thread Execution (UAF) // In the real bug, the thread continues to run with the old pointer value // stored in a global or closure that wasn't cleared. struct svc_channel *dangling_ptr = (struct svc_channel *)0xdeadbeef; // Simulation printf("[-] System Panic triggered.\n"); return 0; }

{"cve": {"id": "CVE-2026-43410", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-05-08T15:16:52.633", "lastModified": "2026-05-21T18:14:24.140", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: stratix10-rsu: Fix NULL pointer dereference when RSU is disabled\n\nWhen the Remote System Update (RSU) isn't enabled in the First Stage\nBoot Loader (FSBL), the driver encounters a NULL pointer dereference when\nexcute svc_normal_to_secure_thread() thread, resulting in a kernel panic:\n\nUnable to handle kernel NULL pointer dereference at virtual address 0000000000000008\nMem abort info:\n...\nData abort info:\n...\n[0000000000000008] user address but active_mm is swapper\nInternal error: Oops: 0000000096000004 [#1] SMP\nModules linked in:\nCPU: 0 UID: 0 PID: 79 Comm: svc_smc_hvc_thr Not tainted 6.19.0-rc8-yocto-standard+ #59 PREEMPT\nHardware name: SoCFPGA Stratix 10 SoCDK (DT)\npstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : svc_normal_to_secure_thread+0x38c/0x990\nlr : svc_normal_to_secure_thread+0x144/0x990\n...\nCall trace:\n svc_normal_to_secure_thread+0x38c/0x990 (P)\n kthread+0x150/0x210\n ret_from_fork+0x10/0x20\nCode: 97cfc113 f9400260 aa1403e1 f9400400 (f9400402)\n---[ end trace 0000000000000000 ]---\n\nThe issue occurs because rsu_send_async_msg() fails when RSU is not enabled\nin firmware, causing the channel to be freed via stratix10_svc_free_channel().\nHowever, the probe function continues execution and registers\nsvc_normal_to_secure_thread(), which subsequently attempts to access the\nalready-freed channel, triggering the NULL pointer dereference.\n\nFix this by properly cleaning up the async client and returning early on\nfailure, preventing the thread from being used with an invalid channel."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-476"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.9", "matchCriteriaId": "E825E7C3-FEAC-4FD3-8A81-78D7387948C9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/aa5739e0c51ad01c6e763ca89c1bfb58fc6ea71a", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/c45f7263100cece247dd3fa5fe277bd97fdb5687", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}