CVE-2026-46203
SPI Controller Unclocked Access in Linux Kernel
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cadence | quadspi | * |
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's cadence-quadspi driver. It involves an unclocked register access that occurs during the driver unbind process. Specifically, the controller must be runtime resumed before it is disabled during unbind to prevent accessing registers without a clock signal.
How can this vulnerability impact me? :
If the controller is accessed without being properly clocked, it could lead to undefined behavior or system instability. This might cause crashes or malfunctions in systems relying on the cadence-quadspi controller, potentially affecting device reliability.