UBUNTU-CVE-2026-90012: Critical severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: spi: Fix DMA mapping ownership on partial map failure If RX mapping fails after TX mapping succeeds, spimapmsg() unmaps TX but leaves txsgmapped set. If TX mapping fails on a later transfer, mappings created for earlier transfers remain active. In both cases, cur{tx,rx}dmadev have not yet been updated because they are assigned only after every transfer has been mapped. The subsequent spiunmapmsg() may therefore unmap the TX mapping again or release earlier mappings using a NULL or stale device. Using a NULL device can trigger an oops. An empty SG table does not prevent the NULL dereference because dmaunmapsgattrs() accesses the device before checking the entry count. Publish both mapping devices before mapping starts and unwind all failures through spiunmapmsg(). This clears the mapping flags and releases each mapping once with the device that created it. Publishing the devices before the loop also refreshes them when no transfer needs mapping. No mapping flag is set in that case, so current users do not use the pointers as mapping owners.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the Linux kernel SPI DMA mapping path, publish both mapping devices before mapping starts, unwind all partial-map failures through __spi_unmap_msg(), and clear mapping flags so each mapping is released exactly once with the device that created it.
Event History
Frequently Asked Questions
Which Ubuntu kernel packages are identified as affected?
The listed packages are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0.
What condition triggers the faulty cleanup path?
The issue occurs when DMA mapping fails partway through SPI message mapping, such as when RX mapping fails after TX mapping succeeds or when TX mapping fails on a later transfer. Cleanup can then attempt to unmap mappings twice or use a NULL or stale DMA device.
What is the potential operational impact?
Using a NULL device during DMA unmapping can trigger a kernel oops. The vulnerability is rated critical with network attack vector, low complexity, no privileges, and no user interaction in the provided severity data.
What does the fix change?
The fix publishes the TX and RX mapping devices before mapping begins and sends all mapping failures through __spi_unmap_msg(). This clears mapping flags and ensures each mapping is released once using the device that created it.