CVE-2026-64221

Analyzed Analyzed - Analysis Complete

SPI Use-After-Free in TI QSPI Driver

Publication date: 2026-07-24

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: spi: ti-qspi: fix use-after-free after DMA setup failure The driver falls back to PIO mode if DMA setup fails during probe. Make sure to clear the DMA channel pointer also if buffer allocation fails to avoid passing a pointer to the released channel to the DMA engine (or trying to free the channel a second time on late probe errors or driver unbind). This issue was flagged by Sashiko when reviewing a devres allocation conversion patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-24

Last Modified

2026-08-11

Generated

2026-08-13

AI Q&A

2026-07-24

EPSS Evaluated

2026-08-12

NVD

CVE-2026-64221

EUVD

EUVD-2026-48629

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.16 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.209 (exc)
linux	linux_kernel	From 4.12 (inc) to 5.10.258 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.92 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.34 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.142 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's TI QSPI driver. It occurs when DMA setup fails during driver probe, causing the driver to fall back to PIO mode. The issue arises because the DMA channel pointer is not cleared when buffer allocation fails, leading to potential use of a freed pointer or double-free errors during DMA operations or driver unbind.

Detection Guidance

This vulnerability is specific to the Linux kernel's spi: ti-qspi driver and involves a use-after-free issue during DMA setup failures. Detection requires checking kernel logs for DMA-related errors or crashes during driver initialization. Commands like dmesg | grep -i qspi or journalctl -k | grep -i qspi may reveal issues.

Impact Analysis

This vulnerability could cause system instability, crashes, or unexpected behavior in systems using the TI QSPI driver with DMA functionality. It may lead to kernel panics, data corruption, or security issues if exploited to execute arbitrary code with kernel privileges.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level Linux kernel driver issue related to memory management and DMA operations. No evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Update the Linux kernel to a patched version where this issue is resolved. If using a custom kernel, ensure the spi: ti-qspi driver is updated to handle DMA failures safely. Monitor kernel logs for DMA-related errors after updates.

Hi! I’m here to help you understand CVE-2026-64221. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70