Executive brief
The Linux kernel's ATCSPI200 SPI controller driver has a timing issue where DMA resources are initialized after the SPI controller is registered. When the driver is unloaded, this can cause the system to attempt to access DMA memory that has already been torn down while the controller is still active, potentially leading to system instability or crashes.
Technical details
A use-after-free vulnerability exists in the ATCSPI200 SPI controller driver (drivers/spi/spi-atcspi200.c). The root cause is incorrect initialization order: DMA resources are configured after the SPI controller is registered with the kernel. Upon driver unbind/removal, DMA teardown occurs while the controller is still alive and may attempt to trigger DMA transfers, resulting in access to freed DMA memory. The fix reorders initialization to configure DMA before registering the controller. This requires local access to unload/reload the driver module.
Affected products
- Linux Linux kernel multiple versions (fix in commit 565bdf45125a05aa8f622f58f598283f46ba43f4)
Timeline
- 2026-04-17: disclosed: Patch authored by Felix Gu
- 2026-04-27: patched: Merged into mainline by Mark Brown
- 2026-07-24: patched: Backported to stable tree by Greg Kroah-Hartman