Executive brief
The Linux kernel's SPI IMX driver has a flaw where DMA-to-PIO fallback operations leave the controller misconfigured, causing data corruption. This affects devices like TPM chips connected via SPI on i.MX8MP boards, leading to corrupted reads and device initialization failures. Organizations using affected systems may experience hardware authentication failures and operational disruptions.
Technical details
The vulnerability is a configuration state bug in the SPI IMX driver. When DMA mode is initially selected but the DMA descriptor preparation fails (dmaengine_prep_slave_single() returns NULL), the driver attempts to fall back to PIO mode. However, the DMA-mode configuration (CTRL.SMC bit, dynamic_burst settings, and SDMA watermarks) is not undone before switching to PIO, causing the PIO transfer to execute with incorrect controller settings. This results in data corruption. The bug is easily triggered on i.MX8MP boards running SDMA without external firmware, where every ECSPI DMA prepare fails. The fix sets controller->fallback before re-running spi_imx_setupxfer() to force proper PIO reconfiguration. No network attack vector; requires local hardware access or affected SoC operation.
Affected products
- Linux Linux kernel prior to fix (released 2026-08-15)
Timeline
- 2026-08-15: disclosed
- 2026-08-15: patched: Fix committed to resolve SPI IMX DMA fallback misconfiguration