Riskcovery

CVE-2026-93249

spi: amlogic-spisg: Make sure clk_init_data is fully initialized

State
Published
Severity
Not scored
Published
Sep 24, 2026
Updated
Oct 19, 2026
Reserved
Sep 17, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

spi: amlogic-spisg: Make sure clk_init_data is fully initialized

The clk_init_data structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drivers to initialize only the members they need. However, not initializing all members may cause subtle issues, which are only exposed when CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE is enabled.

aml_spisg_clk_init() fills in init.parent_data, and assumes that init.parent_names is NULL. However, the latter in uninitialized, and thus may cause a crash.

Make sure all members are fully initialized, to fix such bugs, and to avoid future breakage when converting drivers to a different method for specifying the parents.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • cef9991e04aed3305c61c392e880f6e01a0c2ea4 to before bfce0f324efaa605e606cbb3f0bdb8fe5c910c11Affected
  • cef9991e04aed3305c61c392e880f6e01a0c2ea4 to before 5969a3df8361a0e20379a308c2313d3e263123deAffected
  • cef9991e04aed3305c61c392e880f6e01a0c2ea4 to before b2702908ee23ef31bfcf241a2e07ace0eb76bd71Affected
LinuxLinux
  • 6.17Affected
  • before 6.17Not affected
  • 6.18.52 through 6.18.*Not affected
  • 7.2.6 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.