Executive brief
The Linux kernel's SPI (Serial Peripheral Interface) driver manages DMA (Direct Memory Access) mapping for data transfers. A bug in error handling causes the driver to attempt unmapping memory using a NULL or stale device pointer when a transfer mapping fails partway through, triggering a kernel crash (oops). This affects systems using SPI devices with DMA enabled, potentially causing service disruptions or kernel panics.
Technical details
The vulnerability is a use-after-free and NULL pointer dereference in the SPI subsystem's DMA mapping logic. When RX mapping fails after TX mapping succeeds, or when TX mapping fails on a later transfer, the __spi_map_msg() function unmaps the TX data but leaves the tx_sg_mapped flag set. The cur_tx_dma_dev and cur_rx_dma_dev pointers are only updated after all transfers are successfully mapped, so subsequent calls to spi_unmap_msg() may attempt to unmap using a NULL or stale device pointer. The dma_unmap_sg_attrs() function accesses the device structure before checking the scatter-gather table length, guaranteeing a NULL pointer dereference. The fix publishes the mapping devices before the mapping loop begins and unwinds all failures through a proper cleanup path, ensuring each mapping is unmapped with the correct device.
Affected products
- Linux Linux kernel multiple versions (fix backported across stable branches 3.x through 7.x)
Timeline
- 2026-09-16: disclosed: CVE-2026-90012 published
- 2026-08-14: patched: Fix committed upstream (commit 367cea239fc93094e5c16a72724800e0358f5c46)
- 2026-09-11: other: Backported to stable tree (commit 5def8b6aaad44603740786262b95b6f77df52a1c)