Executive brief
The Linux kernel SPI Xilinx driver incorrectly calculates FIFO buffer size by not accounting for the hardware's shift register, resulting in off-by-one errors. This causes data loss during SPI transactions and can lead to the driver locking up indefinitely when processing buffers at or larger than the stated FIFO size.
Technical details
The vulnerability is a logic error in FIFO size detection within the spi-xilinx driver. The driver determines TX FIFO size by writing bytes until the FIFO FULL flag asserts, but fails to account for an additional shift register that holds one byte, causing it to report size+1. This miscalculation is mirrored for the RX FIFO. When a SPI transaction sends data equal to or larger than the stated FIFO size, the shift register causes data to overflow the RX FIFO (losing one byte), and subsequent RX FIFO status checks spin in an infinite loop when the register is empty, freezing the driver. The fix involves using the hardware's FIFO occupancy register to accurately determine the true FIFO depth. This is a local, non-exploitable logic error affecting kernel driver reliability.
Affected products
- Linux Linux kernel multiple versions
Timeline
- 2026-08-15: patched: Patch published resolving FIFO size determination logic
- 2026-08-15: disclosed