9.8

CVE-2026-64303

spi: fsl-lpspi: terminate the RX channel on TX prepare failure path

In the Linux kernel, the following vulnerability has been resolved:

spi: fsl-lpspi: terminate the RX channel on TX prepare failure path

When dmaengine_prep_slave_sg() fails for the TX channel, the error path
terminates the TX DMA channel but leaves the RX channel running. Since
the RX channel was already submitted and issued prior to preparing
the TX descriptor, returning -EINVAL causes the SPI core to unmap the
DMA buffers while the RX DMA engine continues writing to them, leading
to potential memory corruption or use-after-free.

Terminate the RX channel before returning on the TX prepare failure path.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 5.2 < 5.10.261
Linux ≫ Linux Kernel Version >= 5.11 < 5.15.212
Linux ≫ Linux Kernel Version >= 5.16 < 6.1.178
Linux ≫ Linux Kernel Version >= 6.2 < 6.6.145
Linux ≫ Linux Kernel Version >= 6.7 < 6.12.96
Linux ≫ Linux Kernel Version >= 6.13 < 6.18.39
Linux ≫ Linux Kernel Version >= 6.19 < 7.1.4
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.68% 0.485
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://git.kernel.org/stable/c/ad370d1c7a9a832f77b2341513cd31188c9443af
Patch
https://git.kernel.org/stable/c/cce2063404b2341e7b2bbf85eddfcd70a31a0033
Patch
https://git.kernel.org/stable/c/af39a2698f69b584d14a00cffe0f51a2caa15337
Patch
https://git.kernel.org/stable/c/e65505d91fa036a238968e4c10744244d1b968c4
Patch
https://git.kernel.org/stable/c/d5c1060218a3749c8a18b36f8169d910fce20639
Patch
https://git.kernel.org/stable/c/808033d80d5c9f8adf7e8de9317389270ce13430
Patch
https://git.kernel.org/stable/c/9d000bdd250d649a11cd7f733175686877344582
Patch
https://git.kernel.org/stable/c/01980b5da56e573d62798d0ff6c86bcaa2b22cbe
Patch