Executive brief
A vulnerability in the Linux kernel's SPI driver for NXP Freescale LPSPI controllers could lead to memory corruption. When a specific data transmission step fails, the system incorrectly leaves a data receiving process running while cleaning up its memory. This can result in the system writing data to memory that has already been freed or reassigned, potentially causing system instability or crashes.
Technical details
A vulnerability exists in the fsl-lpspi SPI driver within the Linux kernel due to improper error handling in the fsl_lpspi_dma_transfer function. When dmaengine_prep_slave_sg() fails for the TX channel, the error path terminates the TX DMA channel but leaves the RX channel active. Because the RX channel is submitted prior to the TX descriptor preparation, returning -EINVAL causes the SPI core to unmap DMA buffers while the RX engine is still writing to them. This results in a use-after-free condition or memory corruption. The issue has been resolved by ensuring the RX channel is terminated before returning on the TX failure path.
Affected products
- Linux Linux Kernel 5.2 to 6.10.y
Timeline
- 2026-05-25: disclosed: Initial patch submitted by Carlos Song
- 2026-07-25: advisory: CVE-2026-64303 published
References
- https://git.kernel.org/stable/c/01980b5da56e573d62798d0ff6c86bcaa2b22cbe
- https://git.kernel.org/stable/c/808033d80d5c9f8adf7e8de9317389270ce13430
- https://git.kernel.org/stable/c/9d000bdd250d649a11cd7f733175686877344582
- https://git.kernel.org/stable/c/ad370d1c7a9a832f77b2341513cd31188c9443af
- https://git.kernel.org/stable/c/af39a2698f69b584d14a00cffe0f51a2caa15337
- https://git.kernel.org/stable/c/cce2063404b2341e7b2bbf85eddfcd70a31a0033
- https://git.kernel.org/stable/c/d5c1060218a3749c8a18b36f8169d910fce20639