Look up another CVE · open CVE-2026-72134 in the interactive tracker
CVE-2026-72134
spi: imx: reconfigure for PIO when DMA cannot be started
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem drivers/spi. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-72134 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
When spi_imx_can_dma() selects DMA, the ECSPI is configured for DMA: spi_imx_setupxfer() sets CTRL.SMC and clears dynamic_burst, and spi_imx_dma_transfer() programs the dynamic-burst BURST_LENGTH and the SDMA watermarks. If the DMA descriptor cannot be prepared (dmaengine_prep_slave_single() returns NULL), the transfer is failed with SPI_TRANS_FAIL_NO_START and falls back to PIO. The dynamic-burst DMA path uses its own bounce buffers instead of the SPI core's mapping, so xfer->{tx,rx}_sg_mapped are not set and the core's DMA->PIO retry is skipped; the driver falls back to PIO internally. But none of the DMA-mode configuration is undone, so the PIO transfer runs with CTRL.SMC set, the wrong burst length and dynamic_burst cleared, and the transferred data is corrupted. This is easily hit on i.MX8MP boards that describe ECSPI DMA in the device tree but run SDMA on ROM firmware (no external sdma-imx7d.bin): every ECSPI DMA prepare fails. An Infineon SLB9670 TPM on ECSPI1 then returns shifted TPM2_GetCapability data, is flagged "field failure mode", /dev/tpmrm0 is never created. Set controller->fallback before re-running spi_imx_setupxfer() so the ECSPI is reconfigured exactly like a normal PIO transfer. With controller->fallback set, spi_imx_setupxfer() sees spi_imx_can_dma() return false, so it clears spi_imx->usedma and reprograms the controller (clears CTRL.SMC, restores dynamic_burst and the PIO burst length). No explicit spi_imx->usedma = false is needed: setupxfer() already updates it from the can_dma() result.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/spi/spi-imx.c
- What this is
- SPI SUBSYSTEMMAINTAINERS section matched on drivers/spi/ · linux-spi@vger.kernel.org · Maintained
- Kernel module
- spi_imx
Check it on the machine
grep -wE 'CONFIG_SPI|CONFIG_SPI_IMX' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w spi_imxPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookwormMnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt/amd64, arm64/cloud-arm64, i386/686, i386/686-pae, i386/rt/686-pae, ppc64el/powerpc64le
- trixieMnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt/amd64, arm64/cloud-arm64, armel/rpi, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, riscv64/riscv64, s390x/s390x
- forky, sidMnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt-amd64, arm64/cloud-arm64, loong64/loong64, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, riscv64/riscv64, s390x/s390x
- M
- a module where it is built at all; some flavours do not build it
- Build switches
- CONFIG_SPI, CONFIG_SPI_IMX
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.17%, higher than 5.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- drivers/spi
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 7.0 | 7.1.5 | 40dee2d3e999 |
| 7.0 | 7.2 | 245404c26563 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The flaw is in the Freescale i.MX ECSPI host driver reached only through local SPI core APIs (spidev ioctl/read/write or in-kernel spi_sync/spi_write_then_read); it is not triggered by remote network packets or adjacent radio frames.
- AC:LAttack complexity, low
- On common i.MX8MP boards with ECSPI DMA enabled but SDMA firmware missing, every transfer >=64 bytes deterministically hits the DMA-prepare-fail PIO fallback; attackers can also force dmaengine_prep_slave_single() failure via DMA resource pressure without races.
- PR:LPrivileges required, low
- Exploitation requires local ability to drive SPI traffic, typically via /dev/spidev group membership or unprivileged use of TPM/MTD interfaces on embedded i.MX systems; it is not reachable from unauthenticated remote network input alone.
- UI:NUser interaction, none
- No victim interaction is required; the corrupted fallback is exercised automatically during kernel driver SPI transfers (e.g., TPM probe at boot) or by the attacker's own spidev ioctl without needing another user to mount or open resources.
- S:UScope, unchanged
- Impact is confined to the same host kernel and its locally attached SPI slaves (TPM, NOR flash, sensors); it does not cross a VM, container, or IOMMU security boundary to another authority.
- C:HConfidentiality impact, high
- Corrupted PIO RX with stale DMA burst/SMC settings delivers shifted security-peripheral responses (e.g., TPM2_GetCapability) and misaligned NOR-flash reads into kernel and userspace buffers, disclosing sensitive device data beyond correct protocol parsing.
- I:HIntegrity impact, high
- Stale DMA-mode CTRL settings cause corrupted SPI writes that can alter TPM commands, NOR-flash contents, and other attached secure-element or firmware-store data on i.MX ECSPI buses used in embedded and automotive deployments.
- A:HAvailability impact, high
- Demonstrated total loss of TPM availability (/dev/tpmrm0 never created after shifted capability reads) and reliable breakage of all large ECSPI transfers on affected i.MX8MP SDMA-ROM configurations, denying security and storage services.