CVE-2026-23202
Race Condition in Linux Tegra210 QSPI Causes Use-After-Free
Publication date: 2026-02-14
Last updated on: 2026-03-19
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 6.17.13 (inc) to 6.18 (exc) |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 6.12.63 (inc) to 6.12.70 (exc) |
| linux | linux_kernel | From 6.18.2 (inc) to 6.18.10 (exc) |
| linux | linux_kernel | From 6.6.120 (inc) to 6.6.124 (exc) |
| linux | linux_kernel | From 5.15.198 (inc) to 5.15.200 (exc) |
| linux | linux_kernel | From 6.1.160 (inc) to 6.1.163 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's spi driver for the tegra210-quad device. The issue arises because the curr_xfer field is accessed by an interrupt handler (IRQ handler) without proper locking, which means it can be read while being updated concurrently. Specifically, the curr_xfer field is used to check if a transfer is in progress, but it is cleared in the combined sequence transfer loop without holding a spinlock. This lack of synchronization can cause a race condition between the IRQ handler and the transfer loop.
If the IRQ handler reads a partially updated curr_xfer value due to this race, it can lead to a NULL pointer dereference or use-after-free error, potentially causing system instability or crashes.
How can this vulnerability impact me? :
This vulnerability can impact you by causing system instability or crashes due to NULL pointer dereference or use-after-free conditions triggered by the race condition in the kernel's SPI driver. Such crashes could lead to denial of service or unexpected behavior in systems using the affected tegra210-quad SPI driver.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Linux kernel to a version where the issue in the tegra210-quad SPI driver has been fixed. This fix involves protecting the curr_xfer field with a spinlock in the tegra_qspi_combined_seq_xfer function to prevent race conditions that could lead to NULL pointer dereference or use-after-free.
Ensure that your system is running the patched kernel version released after 2026-02-14, which includes this fix.