UBUNTU-CVE-2026-93249: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: spi: amlogic-spisg: Make sure clkinitdata is fully initialized The clkinitdata structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drivers to initialize only the members they need. However, not initializing all members may cause subtle issues, which are only exposed when CONFIGINITSTACKALLPATTERN or CONFIGINITSTACKNONE is enabled. amlspisgclkinit() fills in init.parentdata, and assumes that init.parentnames is NULL. However, the latter in uninitialized, and thus may cause a crash. Make sure all members are fully initialized, to fix such bugs, and to avoid future breakage when converting drivers to a different method for specifying the parents.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure aml_spisg_clk_init() fully initializes every member of clk_init_data, including explicitly setting init.parent_names to NULL when using init.parent_data.
Linux kernel spi: amlogic-spisg clk_init_data members = Fully initialized; init.parent_names = NULL when init.parent_data is populated