Executive brief
A vulnerability was identified in the Linux kernel's SPI driver for Cirrus EP93xx processors. This driver manages communication between the main processor and peripheral devices. If the system fails to set up a high-speed data transfer method (DMA), it may later attempt to use invalid memory addresses, potentially leading to a system crash or instability.
Technical details
A vulnerability in the 'spi-ep93xx' driver in the Linux kernel arises from improper error handling during DMA channel allocation. When 'dma_request_chan' fails, the driver correctly falls back to PIO mode but fails to nullify the 'dma_rx' or 'dma_tx' pointers, leaving them containing an ERR_PTR value. Subsequent driver operations, such as unbinding the driver or handling later probe errors, may attempt to dereference these pointers, leading to a kernel oops or crash. The fix involves explicitly setting these pointers to NULL upon setup failure. This affects systems using Cirrus Logic EP93xx SoCs.
Affected products
- Linux Linux 6.12, 6.18, 7.0, 7.1
Timeline
- 2026-07-19: disclosed
- 2026-07-19: advisory