Executive brief
A vulnerability in the Linux kernel's Amlogic SPI Flash Controller driver could allow a local attacker to cause system instability or potentially gain unauthorized access. The issue stems from how the system handles memory management errors during data transfers. If exploited, this could lead to a system crash or the corruption of sensitive data stored in memory.
Technical details
Multiple flaws were identified in the aml_sfc_dma_buffer_setup() function within the Amlogic SPI Flash Controller (spifc-a4) driver. The primary issues include a double-unmap vulnerability where a DMA address is unmapped twice during an error path, and an incorrect unmap size calculation that uses 'datalen' instead of 'infolen'. These memory management errors can lead to kernel memory corruption or use-after-free scenarios. An attacker with local access could trigger these error paths to cause a denial of service (system crash) or potentially escalate privileges. Patches have been released for various stable kernel branches including 6.18.y and 6.19.y.
Affected products
- Linux Linux Kernel 6.18 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1 to 7.0-rc3
Timeline
- 2026-05-08: advisory: Initial disclosure of CVE-2026-43461
- 2026-03-19: patched: Fixes merged into stable kernel trees