CVE-2026-64303

spi: fsl-lpspi: terminate the RX channel on TX prepare failure path

State: Published
Severity: 9.8 Critical
Published: Jul 25, 2026
Updated: Oct 19, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

spi: fsl-lpspi: terminate the RX channel on TX prepare failure path

When dmaengine_prep_slave_sg() fails for the TX channel, the error path terminates the TX DMA channel but leaves the RX channel running. Since the RX channel was already submitted and issued prior to preparing the TX descriptor, returning -EINVAL causes the SPI core to unmap the DMA buffers while the RX DMA engine continues writing to them, leading to potential memory corruption or use-after-free.

Terminate the RX channel before returning on the TX prepare failure path.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	09c04466ce7ea494993c0635ba5edb6d2222a806 to before ad370d1c7a9a832f77b2341513cd31188c9443afAffected 09c04466ce7ea494993c0635ba5edb6d2222a806 to before cce2063404b2341e7b2bbf85eddfcd70a31a0033Affected 09c04466ce7ea494993c0635ba5edb6d2222a806 to before af39a2698f69b584d14a00cffe0f51a2caa15337Affected 09c04466ce7ea494993c0635ba5edb6d2222a806 to before e65505d91fa036a238968e4c10744244d1b968c4Affected 09c04466ce7ea494993c0635ba5edb6d2222a806 to before d5c1060218a3749c8a18b36f8169d910fce20639Affected 09c04466ce7ea494993c0635ba5edb6d2222a806 to before 808033d80d5c9f8adf7e8de9317389270ce13430Affected 09c04466ce7ea494993c0635ba5edb6d2222a806 to before 9d000bdd250d649a11cd7f733175686877344582Affected 09c04466ce7ea494993c0635ba5edb6d2222a806 to before 01980b5da56e573d62798d0ff6c86bcaa2b22cbeAffected
LinuxLinux	5.2Affected before 5.2Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.96 through 6.12.Not affected 6.18.39 through 6.18.Not affected 7.1.4 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

09c04466ce7ea494993c0635ba5edb6d2222a806 to before ad370d1c7a9a832f77b2341513cd31188c9443afAffected
09c04466ce7ea494993c0635ba5edb6d2222a806 to before cce2063404b2341e7b2bbf85eddfcd70a31a0033Affected
09c04466ce7ea494993c0635ba5edb6d2222a806 to before af39a2698f69b584d14a00cffe0f51a2caa15337Affected
09c04466ce7ea494993c0635ba5edb6d2222a806 to before e65505d91fa036a238968e4c10744244d1b968c4Affected
09c04466ce7ea494993c0635ba5edb6d2222a806 to before d5c1060218a3749c8a18b36f8169d910fce20639Affected
09c04466ce7ea494993c0635ba5edb6d2222a806 to before 808033d80d5c9f8adf7e8de9317389270ce13430Affected
09c04466ce7ea494993c0635ba5edb6d2222a806 to before 9d000bdd250d649a11cd7f733175686877344582Affected
09c04466ce7ea494993c0635ba5edb6d2222a806 to before 01980b5da56e573d62798d0ff6c86bcaa2b22cbeAffected

LinuxLinux

5.2Affected
before 5.2Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.96 through 6.12.*Not affected
6.18.39 through 6.18.*Not affected
7.1.4 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.