Executive brief
A vulnerability was identified in the Linux kernel's SPI driver for Samsung S3C64XX processors. The issue occurs when the driver is unloaded or 'unbound' from the system, which can cause the operating system to crash (kernel panic). This primarily impacts system stability and availability for devices using this specific hardware component.
Technical details
A NULL pointer dereference exists in the s3c64xx_spi_remove() function within drivers/spi/spi-s3c64xx.c. The vulnerability was introduced when DMA channel allocation was moved from the probe() stage to the transfer preparation stage, but the corresponding deallocation logic (dma_release_channel) was erroneously left in the remove() function. When the driver is unbound, it attempts to release DMA channels that may not be currently allocated, resulting in a NULL pointer dereference. This is a local vulnerability that requires the ability to trigger a driver unbind operation. Patches have been released across multiple stable kernel branches.
Affected products
- Linux Linux Kernel 6.0 and later
Timeline
- 2026-04-10: disclosed: Initial patch submitted by Johan Hovold
- 2026-06-08: advisory: CVE-2026-46296 published
References
- https://git.kernel.org/stable/c/1108b8722b9ff0cdd3e8aa18d98244fcd93b6760
- https://git.kernel.org/stable/c/1b66f16a571a10ba8889ac471755c8af9c5b9266
- https://git.kernel.org/stable/c/22788b1a8611380b141e09a8896702e32d164238
- https://git.kernel.org/stable/c/323a258f4b1916b5a3098618e036e033b2f2317f
- https://git.kernel.org/stable/c/45daacbead8a009844bd5dba6cfa731332184d17