Executive brief
A vulnerability in the Linux kernel's SPI device driver can cause the system to freeze or crash (deadlock). This occurs when multiple programs or threads attempt to read, write, or configure the same SPI device simultaneously. An attacker with local access could exploit this to cause a denial-of-service, impacting the availability of systems that rely on SPI-connected hardware.
Technical details
A lock inversion (AB-BA) vulnerability exists in the Linux kernel 'spidev' driver due to inconsistent acquisition orders of 'spi_lock' and 'buf_lock'. The read/write code paths acquired 'buf_lock' then 'spi_lock', while the ioctl path acquired them in the reverse order. A local attacker can trigger a deadlock by running a multi-threaded program that performs simultaneous write() and ioctl() calls on the same spidev file descriptor. The fix simplifies the locking model by removing 'buf_lock' and serializing all access through 'spi_lock'. Patches have been merged into the stable kernel trees.
Affected products
- Linux Linux Kernel All versions prior to the fix in 2026-02-17
Timeline
- 2026-02-11: other: Initial patch submitted by developer
- 2026-02-17: patched: Patch committed to main SPI tree
- 2026-05-08: disclosed: CVE-2026-43319 published