Bug 2506812 (CVE-2026-64221)

Summary:	CVE-2026-64221 kernel: Linux kernel: spi: ti-qspi use-after-free allows privilege escalation or denial of service
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability-draft	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the `spi: ti-qspi` component of the Linux kernel. This use-after-free vulnerability occurs when the driver attempts to fall back to PIO mode after a Direct Memory Access (DMA) setup failure during probe. If the DMA channel pointer is not properly cleared after a buffer allocation failure, it can lead to the use of a freed memory region. This could allow a local attacker to cause a denial of service or potentially escalate privileges.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-24 16:05:09 UTC

In the Linux kernel, the following vulnerability has been resolved:

spi: ti-qspi: fix use-after-free after DMA setup failure

The driver falls back to PIO mode if DMA setup fails during probe.

Make sure to clear the DMA channel pointer also if buffer allocation
fails to avoid passing a pointer to the released channel to the DMA
engine (or trying to free the channel a second time on late probe errors
or driver unbind).

This issue was flagged by Sashiko when reviewing a devres allocation
conversion patch.

Comment 1 Mauro Matteo Cascella 2026-07-28 11:46:56 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026072416-CVE-2026-64221-299d@gregkh/T