CVE-2026-46203: spi: cadence-quadspi: fix unclocked access on unbind
In the Linux kernel, the following vulnerability has been resolved:
spi: cadence-quadspi: fix unclocked access on unbind
Make sure that the controller is runtime resumed before disabling it during driver unbind to avoid an unclocked register access.
This issue was flagged by Sashiko when reviewing a controller deregistration fix.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch spi: cadence-quadspi: fix unclocked access on unbind - Configuration
Ensure the controller is runtime-resumed before disabling it during driver unbind to avoid unclocked register access. Implement or backport the fix in the cadence-quadspi driver so unbind performs a runtime resume prior to disabling.
Linux kernel (spi: cadence-quadspi driver) runtime_resume_before_disable = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46203?
CVE-2026-46203 has a severity rating of 12, indicating a significant risk level.
How do I fix CVE-2026-46203?
To fix CVE-2026-46203, ensure that the controller is runtime resumed before disabling it during the driver unbind process.
What impact does CVE-2026-46203 have on the Linux kernel?
CVE-2026-46203 can lead to unclocked register access, which may compromise the stability and security of the Linux kernel.
In which versions of the Linux kernel is CVE-2026-46203 applicable?
CVE-2026-46203 is applicable to versions of the Linux kernel that use the cadence-quadspi driver.
Who reported CVE-2026-46203?
CVE-2026-46203 was flagged by Sashiko during a code review process.