Executive brief
A vulnerability in the Linux kernel's Serial Peripheral Interface (SPI) subsystem could allow a local user to crash the system. The issue occurs because the system attempts to provide hardware statistics through the file system before the necessary memory has been set up. This can lead to a system failure (NULL-pointer dereference) if these statistics are accessed during a specific startup window.
Technical details
A race condition exists in the Linux kernel SPI subsystem (drivers/spi/spi.c) where per-cpu statistics are allocated only after the controller has been registered with the driver core. This creates a race window where a local attacker or a system process accessing SPI statistics via sysfs attributes can trigger a NULL-pointer dereference because the 'pcpu_statistics' pointer has not yet been initialized. The fix involves moving the statistics allocation to the initial controller allocation phase and explicitly managing its lifetime relative to the controller object. This vulnerability affects kernels starting from version 6.0 where per-cpu statistics were introduced.
Affected products
- Linux Linux Kernel 6.0 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.20, 6.19 to 6.19.10, 7.0-rc1 to 7.0-rc4
Timeline
- 2026-03-12: other: Patch authored
- 2026-03-25: patched: Patch committed to stable trees
- 2026-04-03: disclosed: CVE published
References
- https://git.kernel.org/stable/c/118ce777d39f03cac99231196f820e4f998613a8
- https://git.kernel.org/stable/c/378b295f67102eef78cf2c28105f60ae1dab5cc1
- https://git.kernel.org/stable/c/80c5bd0dca1cc5526ae0f4b273ccd163ed4caa4e
- https://git.kernel.org/stable/c/dee0774bbb2abb172e9069ce5ffef579b12b3ae9
- https://git.kernel.org/stable/c/df30056c78e8bead02d4be020199cabdbec0fef1
- https://git.kernel.org/stable/c/f13100b1f5f111989f0750540a795fdef47492af