CVE-2026-64221: spi: ti-qspi: fix use-after-free after DMA setup failure
In the Linux kernel, the following vulnerability has been resolved:
spi: ti-qspi: fix use-after-free after DMA setup failure
The driver falls back to PIO mode if DMA setup fails during probe.
Make sure to clear the DMA channel pointer also if buffer allocation fails to avoid passing a pointer to the released channel to the DMA engine (or trying to free the channel a second time on late probe errors or driver unbind).
This issue was flagged by Sashiko when reviewing a devres allocation conversion patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (spi: ti-qspi)to a version that resolves this vulnerability.Patch spi: ti-qspi: fix use-after-free after DMA setup failure
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel TI QSPI SPI driver are affected when DMA setup fails during driver probe and the driver falls back to PIO mode. The issue involves a stale pointer to a DMA channel that has already been released.
What level of access is required for exploitation?
An attacker would need local access and low privileges, as reflected by the CVSS vector. Exploitation depends on reaching the affected driver error path after DMA setup failure.
What could happen if the vulnerable path is reached?
The described failure path can later pass the released DMA-channel pointer to the DMA engine or attempt to release it a second time, including during late probe errors or driver unbind. This can result in use-after-free behavior.