Look up another CVE · open CVE-2026-64303 in the interactive tracker
CVE-2026-64303
spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
Published 2026-07-25 (3 months ago) by the Linux kernel CNA. Subsystem drivers/spi. Debian urgency: not yet assigned.
Debian does not build this code. The per-release build detail is under "Where it lives" below.
What to do, per Debian release
Debian's own status for CVE-2026-64303 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4720-1 · 2026-08-05 · text | 6.1.180-1 | Update the kernel and reboot. DLA-4720-1 shipped the fix on 2026-08-05, in 6.1.180-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.96-1 | Update the kernel and reboot. Fixed in 6.12.96-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.4-1 | Update the kernel and reboot. Fixed in 7.1.4-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.4-1 | Update the kernel and reboot. Fixed in 7.1.4-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4724-1 · 2026-08-07 · text | 6.12.100-1~deb12u1 | Update the kernel and reboot. DLA-4724-1 shipped the fix on 2026-08-07, in 6.12.100-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
When dmaengine_prep_slave_sg() fails for the TX channel, the error path terminates the TX DMA channel but leaves the RX channel running. Since the RX channel was already submitted and issued prior to preparing the TX descriptor, returning -EINVAL causes the SPI core to unmap the DMA buffers while the RX DMA engine continues writing to them, leading to potential memory corruption or use-after-free. Terminate the RX channel before returning on the TX prepare failure path.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/spi/spi-fsl-lpspi.c
- What this is
- FREESCALE IMX LPSPI DRIVERMAINTAINERS section matched on drivers/spi/spi-fsl-lpspi.c · linux-spi@vger.kernel.org · Maintained
- Kernel module
- none to look for. The file would have gone into spi_fsl_lpspi, and Debian does not compile it into that module, so finding spi_fsl_lpspi in lsmod would say nothing about this CVE.
Check it on the machine
grep -wE 'CONFIG_SPI|CONFIG_SPI_FSL_LPSPI' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian does not build this code. In 5 releases below, every kernel flavour Debian publishes has the switch off, so the vulnerable file is compiled into no kernel binary Debian ships.
- bookworm, trixie, forky, sid, bookworm · linux-6.12n
- n
- not enabled on any flavour - this release does not build the code
- Build switches
- CONFIG_SPI, CONFIG_SPI_FSL_LPSPI
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-07-25 (3 months ago)source
- CVSS
- 9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.69%, higher than 52.0% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/spi
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.2 | 5.10.261 | ad370d1c7a9a |
| 5.2 | 5.15.212 | cce2063404b2 |
| 5.2 | 6.1.178 | af39a2698f69 |
| 5.2 | 6.6.145 | e65505d91fa0 |
| 5.2 | 6.12.96 | d5c1060218a3 |
| 5.2 | 6.18.39 | 808033d80d5c |
| 5.2 | 7.1.4 | 9d000bdd250d |
| 5.2 | 7.2 | 01980b5da56e |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4724-1 | 2026-08-07 | bookworm 6.12.100-1~deb12u1 | tracker |
| DLA-4723-1 | 2026-08-07 | bullseye 6.1.180-1~deb11u1 | tracker |
| DLA-4720-1 | 2026-08-05 | bookworm 6.1.180-1 | tracker |
| DLA-4717-1 | 2026-08-05 | bullseye 5.10.262-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- In a reasonable network-facing deployment, an SPI Ethernet controller such as ENC28J60 receives an unauthenticated remote frame, raises its IRQ, and calls spi_sync(), which traverses the SPI core into the vulnerable fsl-lpspi DMA path.
- AC:LAttack complexity, low
- An attacker can repeatedly drive DMA preparation and influence GFP_NOWAIT allocation pressure with packet flooding; once TX preparation fails after RX issuance, subsequent traffic deterministically exercises the stale RX descriptor without a race to win.
- PR:NPrivileges required, none
- The SPI Ethernet receive IRQ path runs before protocol authentication and has no capability, device-node, or namespace privilege check, so a remote sender needs no privileges.
- UI:NUser interaction, none
- No victim action is needed after the network interface and SPI NIC are configured; attacker traffic alone invokes the affected transfer path.
- S:UScope, unchanged
- The stale DMA corrupts memory within the same host kernel security authority and does not inherently cross a VM, IOMMU, or other security scope boundary.
- C:HConfidentiality impact, high
- The active RX DMA descriptor can write device- and packet-influenced data into unmapped, freed, and reallocated kernel memory, yielding memory corruption that can be leveraged for kernel-memory disclosure.
- I:HIntegrity impact, high
- The stale DEV_TO_MEM DMA operation provides attacker-influenced writes into freed or reallocated kernel memory, permitting object corruption and potentially control-flow hijacking or arbitrary kernel code execution.
- A:HAvailability impact, high
- Continued DMA into invalid or repurposed memory can cause an IOMMU fault, kernel oops, panic, or hang, and unauthenticated traffic can trigger the condition repeatedly.