Executive brief
The Linux kernel's UniPhier SPI controller driver registers an interrupt handler before initializing the completion variable that handler uses. An interrupt firing immediately after registration could execute the handler on an uninitialized structure, causing a system crash or unpredictable behavior. This affects systems using UniPhier SoC-based hardware with SPI interfaces.
Technical details
This is a race condition in the UniPhier SPI controller driver (drivers/spi/spi-uniphier.c). The probe function calls devm_request_irq() to register an interrupt handler before calling init_completion() on the xfer_done completion object. Because the interrupt can fire immediately after registration, the interrupt handler may execute and call complete() on an uninitialized completion structure, resulting in undefined behavior including kernel crashes (confirmed with KASAN). The fix reorders the initialization so init_completion() is called before devm_request_irq(). No authentication is required; the vulnerability is local-only and affects any system using the UniPhier SPI driver during device probing.
Affected products
- Linux Linux kernel multiple versions containing the UniPhier SPI driver (spi-uniphier.c)
Timeline
- 2026-06-16: other: Vulnerability reported by Sangyun Kim and Kyungwook Boo
- 2026-06-16: patched: Fix committed upstream (commit f3ad1c87d8201e54b66bd6072442f0b5d5a308ee)
- 2026-08-15: disclosed: CVE-2026-72133 published