CVE-2026-64221

spi: ti-qspi: fix use-after-free after DMA setup failure

State: Published
Severity: 7.8 High
Published: Jul 24, 2026
Updated: Aug 5, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

spi: ti-qspi: fix use-after-free after DMA setup failure

The driver falls back to PIO mode if DMA setup fails during probe.

Make sure to clear the DMA channel pointer also if buffer allocation fails to avoid passing a pointer to the released channel to the DMA engine (or trying to free the channel a second time on late probe errors or driver unbind).

This issue was flagged by Sashiko when reviewing a devres allocation conversion patch.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	c687c46e9e4527c4b4d82bc3cca58c1b08bcfb83 to before 9c6f306a8140962c7284197db54b96fdb5f468d6Affected c687c46e9e4527c4b4d82bc3cca58c1b08bcfb83 to before 3bbbe7ae3fdada0df4157c1ffe989f92dfa8dcd6Affected c687c46e9e4527c4b4d82bc3cca58c1b08bcfb83 to before d6f422b122922d1abee907d673bcc990e5f3672dAffected c687c46e9e4527c4b4d82bc3cca58c1b08bcfb83 to before f2dc841d7dc9063fe9b47ced869b1271e55052aeAffected c687c46e9e4527c4b4d82bc3cca58c1b08bcfb83 to before 1cd927002120678bd5d23c760246639caa53040eAffected c687c46e9e4527c4b4d82bc3cca58c1b08bcfb83 to before d7a076fb596c7b408ed6df74793a597990a6d860Affected c687c46e9e4527c4b4d82bc3cca58c1b08bcfb83 to before 178b9b570c0f75fa7e691490520328b20d19138eAffected c687c46e9e4527c4b4d82bc3cca58c1b08bcfb83 to before ea6ec3343e05f7937a53eb6d7617b3abdb4abc19Affected
LinuxLinux	4.12Affected before 4.12Not affected 5.10.258 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.142 through 6.6.Not affected 6.12.92 through 6.12.Not affected 6.18.34 through 6.18.Not affected 7.0.11 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

c687c46e9e4527c4b4d82bc3cca58c1b08bcfb83 to before 9c6f306a8140962c7284197db54b96fdb5f468d6Affected
c687c46e9e4527c4b4d82bc3cca58c1b08bcfb83 to before 3bbbe7ae3fdada0df4157c1ffe989f92dfa8dcd6Affected
c687c46e9e4527c4b4d82bc3cca58c1b08bcfb83 to before d6f422b122922d1abee907d673bcc990e5f3672dAffected
c687c46e9e4527c4b4d82bc3cca58c1b08bcfb83 to before f2dc841d7dc9063fe9b47ced869b1271e55052aeAffected
c687c46e9e4527c4b4d82bc3cca58c1b08bcfb83 to before 1cd927002120678bd5d23c760246639caa53040eAffected
c687c46e9e4527c4b4d82bc3cca58c1b08bcfb83 to before d7a076fb596c7b408ed6df74793a597990a6d860Affected
c687c46e9e4527c4b4d82bc3cca58c1b08bcfb83 to before 178b9b570c0f75fa7e691490520328b20d19138eAffected
c687c46e9e4527c4b4d82bc3cca58c1b08bcfb83 to before ea6ec3343e05f7937a53eb6d7617b3abdb4abc19Affected

LinuxLinux

4.12Affected
before 4.12Not affected
5.10.258 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.142 through 6.6.*Not affected
6.12.92 through 6.12.*Not affected
6.18.34 through 6.18.*Not affected
7.0.11 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.