Executive brief
A vulnerability was identified in the Linux kernel's Topcliff PCH SPI driver that could lead to a system crash or unpredictable behavior. The issue occurs when the driver is being removed or 'unbound' from the system, where it incorrectly releases memory buffers while they might still be in use by the hardware. This could potentially be exploited by a local user with high privileges to cause a denial-of-service.
Technical details
A use-after-free vulnerability exists in drivers/spi/spi-topcliff-pch.c in the Linux kernel. The root cause is an incorrect teardown sequence in the pch_spi_pd_remove function, where DMA buffers are freed via pch_free_dma_buf() before the driver has finished flushing pending messages in its queue. An attacker with the ability to trigger driver unbinding could potentially exploit this race condition. The fix reorders the removal sequence to ensure the queue is processed and interrupts are freed before the DMA buffers are released. This issue affects systems using the Topcliff PCH SPI controller with DMA enabled.
Affected products
- Linux Linux Kernel 3.1 and later
Timeline
- 2026-04-14: patched: Initial patch authored by Johan Hovold
- 2026-06-08: disclosed: CVE published by kernel.org
References
- https://git.kernel.org/stable/c/0e8e57f9737ea257634db1d152fc430a0788a3e1
- https://git.kernel.org/stable/c/36e58c436d2c2a797800427dc04d74ffd8b6ce1c
- https://git.kernel.org/stable/c/43334836b907adc21eab3079d2e6b26754468786
- https://git.kernel.org/stable/c/4ca90deeca1c7dd72c1c380ba8143565516def2d
- https://git.kernel.org/stable/c/8822980668c96b5aa251c1e2daec1873262b8f3f
- https://git.kernel.org/stable/c/9d72732fe70c11424bc90ed466c7ccfa58b42a9a
- https://git.kernel.org/stable/c/d50ef3553acbacce6f2843304d41d06dca358bb6