Executive brief
A vulnerability in the Linux kernel's Cadence QuadSPI driver could allow a local user with high privileges to crash the system. The issue occurs when a hardware device is forcibly disconnected or 'unbound' while the system is still performing data read or write operations. This can lead to a kernel crash, resulting in a denial of service and potential loss of unsaved data.
Technical details
A race condition exists in the spi-cadence-quadspi.c driver where the code assumes no forced device removal (unbind) will occur during active operations. If a root user triggers a manual unbind via sysfs while indirect read or write operations are in progress, the driver fails to track these active sessions, leading to a kernel NULL pointer dereference or similar crash. The fix implements reference counting (refcount_t) for both attached devices and in-flight operations. This ensures the driver gracefully waits for active operations to complete before proceeding with the removal process. The vulnerability is reachable locally by a user with sufficient privileges to trigger driver unbinding.
Affected products
- Linux Linux Kernel 5.9 to 6.6.125, 6.7 to 6.16.10, 6.17-rc1 to 6.17-rc4
Timeline
- 2025-10-20: disclosed
- 2025-10-20: advisory
- 2025-09-01: patched
References
- https://git.kernel.org/stable/c/56787f4a75907ae99b5f5842b756fa68e2482f6d
- https://git.kernel.org/stable/c/65ed52200080eafce3eead05cf22ce01238defca
- https://git.kernel.org/stable/c/7446284023e8ef694fb392348185349c773eefb3
- https://git.kernel.org/stable/c/8ce3ebbe5c718940b4e94f5c25f5720223f893f8
- https://git.kernel.org/stable/c/8df235f768cea7a5829cb02525622646eb0df5f5
- https://git.kernel.org/stable/c/b7ec8a2b094a33d0464958c2cbf75b8f229098b0