Cloudanix VulnDB

CVE-2026-68183

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A coding mistake in Linux handling for certain hardware chips could slowly use up memory or cause crashes until the operating system is updated.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
High
Impact
Privilege Gain
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability permits memory leaks in the stratix10-svc firmware driver on gen_pool_alloc failure paths and list head corruption from erroneous list_del calls during failed lookups, allowing kernel memory exhaustion or data structure inconsistencies.

Why it matters to the business

Affected systems risk gradual performance degradation or instability in specialized FPGA hardware environments, though low EPSS and absence from KEV 76 days after publication indicate limited operational urgency or broad impact.

How an attack unfolds

An attacker with local kernel access triggers error paths in the svc driver by forcing allocation failures or lookup errors to leak memory or corrupt lists, potentially escalating to denial of service in environments using the Stratix10 service controller.

How to fix it

Apply the upstream kernel commit that replaces devm_kzalloc with kzalloc plus explicit kfree and removes the erroneous list_del in the stratix10-svc free path; rebuild and deploy updated kernels to all affected hosts.

How to confirm the fix worked

Inspect kernel source or git history for the resolved error path around gen_pool_alloc and the list_del removal; confirm running kernel version incorporates the fix via changelog or module symbols.

Typical attack path

  1. Obtain local access on a Linux system with the vulnerable stratix10-svc driver loaded
  2. Induce allocation or lookup failures in the firmware service path
  3. Trigger repeated error handling to exhaust memory or destabilize lists
  4. Leverage resulting kernel state for denial of service

How to detect it

Examine kernel logs for stratix10-svc allocation failures, list corruption warnings, or repeated kzalloc patterns; correlate with process activity invoking firmware services and monitor for abnormal memory growth after 2026-08-10.

What your security team should do

  • Prioritize kernel updates for any systems exposing Stratix10 hardware interfaces
  • Review EPSS trend and exploit maturity data to maintain low-priority monitoring
  • Audit custom drivers or downstream dependents for similar allocation patterns

The record

In the Linux kernel, the following vulnerability has been resolved: firmware: stratix10-svc: fix memory leaks and list corruption bugs Fix a memory leak when gen_pool_alloc() fails by freeing pmem on the error path. Switch pmem allocation from devm_kzalloc() to kzalloc() with explicit kfree() in the free path to match its list-managed lifetime. Remove the erroneous list_del(&svc_data_mem) which corrupted the list head on failed lookups.

Affected packages

Ecosystem Package Introduced Fixed