Junglewise Threat Intelligence

CVE-2025-68746: Linux Kernel use-after-free in tegra210-quad SPI driver

CVE-2025-68746 · Severity: high · CVSS 7.8 · Published 2025-12-24

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's NVIDIA Tegra QSPI driver could allow a local attacker to cause a system crash or potentially execute unauthorized code. The issue occurs when the system is under heavy load, causing a timing error that leaves the system trying to access memory that has already been freed. This affects devices using Tegra210 Quad SPI controllers, which are often used for high-speed data communication with peripheral components.

Technical details

A use-after-free (UAF) vulnerability exists in `drivers/spi/spi-tegra210-quad.c` within the Linux kernel. When the CPU handling QSPI interrupts is excessively busy, the IRQ thread may fail to execute before a transfer timeout occurs. During timeout handling, the driver cleans up pending transfers and marks the corresponding message as failed but fails to nullify the `curr_xfer` field. This results in `curr_xfer` pointing to stale memory. When the IRQ thread eventually runs, it attempts to access this stale pointer. The fix involves setting `curr_xfer` to NULL upon timeout and adding a check in `tegra_qspi_isr_thread` to bail out if `curr_xfer` is NULL. Additionally, interrupts are now cleared on failure to ensure subsequent interrupts can be processed.

Affected products

  • Linux Linux Kernel 5.12 to 6.12.63, 6.1 to 6.1.160, 5.15 to 5.15.198, 6.6 to 6.6.120, 6.17 to 6.17.13

Timeline

  • 2025-10-28: disclosed: Initial patch submitted by NVIDIA developers
  • 2025-12-18: patched: Patch committed to stable kernel trees
  • 2025-12-24: advisory: CVE-2025-68746 published

References

Related threats