CVE-2026-64170
Received Received - Intake

SPI PIO Fallback Error Pointer Dereference in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: spi: qup: fix error pointer deref after DMA setup failure The driver falls back to PIO mode if DMA setup fails during probe. Make sure to the clear the DMA channel pointers on setup failure to avoid dereferencing an error pointer (or attempting to release a channel a second time) on later probe errors or driver unbind. This issue was flagged by Sashiko when reviewing a devres allocation conversion patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64170
EUVD
EUVD-2026-45855

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a driver (spi: qup) that fails to properly clear DMA channel pointers when DMA setup fails during initialization. This can lead to dereferencing an error pointer or attempting to release a channel twice in later errors or driver unbind operations.

Detection Guidance

This vulnerability is specific to the Linux kernel's SPI QUP driver and relates to DMA setup failures. Detection requires checking kernel logs for DMA-related errors during SPI device initialization. Look for messages about DMA channel setup failures or error pointer dereferences in dmesg or journalctl logs.

Impact Analysis

If exploited, this flaw could cause system instability, crashes, or unexpected behavior due to improper handling of DMA resources. It may affect systems using the spi: qup driver, potentially leading to denial of service or data corruption.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or other common standards and regulations. The issue is specific to the Linux kernel's SPI QUP driver and involves a potential error pointer dereference during DMA setup failure. It does not involve data breaches, unauthorized access, or privacy violations that would typically impact compliance with such regulations.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this issue. If you cannot update immediately, monitor SPI device initialization logs for DMA errors and consider disabling DMA for affected SPI devices if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64170. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart