Executive brief
A vulnerability was identified in the Linux kernel's Cadence QuadSPI driver, which manages high-speed flash memory communication. During the process of removing or 'unbinding' the driver, the system could attempt to access hardware components that have already had their power or clock signals cut off. This can lead to system instability or crashes, potentially impacting the availability of the device.
Technical details
A race condition or improper sequencing in the `cqspi_remove` function of the `spi-cadence-quadspi.c` driver leads to unclocked register access. Specifically, the driver attempted to disable the controller (`cqspi_controller_enable`) before ensuring the device was runtime resumed via `pm_runtime_get_sync`. This results in hardware register access while the peripheral clocks are disabled. An attacker with sufficient privileges to trigger driver unbinding could potentially cause a kernel oops or system hang. The fix ensures the controller is resumed before the disable sequence and clock de-preparation occurs.
Affected products
- Linux Linux Kernel 6.7 and later
Timeline
- 2026-04-21: other: Patch authored by Johan Hovold
- 2026-05-28: advisory: CVE published in NVD