CVE-2026-64303

9.8

Linux · Kernel

A memory corruption vulnerability exists in the Linux kernel fsl-lpspi driver where improper error handling during DMA preparation can lead to use-after-free or system instability.

Executive summary

A critical memory corruption vulnerability in the Linux kernel fsl-lpspi driver requires immediate attention as it may allow for system instability or unauthorized memory access.

Vulnerability

The vulnerability stems from an error handling flaw in the fsl-lpspi driver, where the RX DMA channel is not properly terminated if the TX channel preparation fails. This causes the SPI core to unmap DMA buffers while the RX engine is still active, leading to potential use-after-free or memory corruption conditions.

Business impact

The exploitation of this vulnerability could lead to a complete system crash (Denial of Service) or potential privilege escalation if an attacker can manipulate the corrupted memory. With a CVSS score of 9.8, the severity is critical, reflecting the potential for full system compromise in environments utilizing the affected fsl-lpspi hardware interface.

Remediation

Immediate Action: Apply the vendor-provided kernel patches by updating the Linux kernel to version 5.10.261, 5.15.212, 6.1.178, 6.6.145, or newer.

Proactive Monitoring: Monitor system logs for kernel panics or unexpected hardware-related error messages that may indicate memory corruption events.

Compensating Controls: Restrict access to systems utilizing the fsl-lpspi driver to trusted users only, as this limits the local attack surface while awaiting patch deployment.

Exploitation status

Public Exploit Available: Unknown

Analyst recommendation

Due to the critical nature of kernel-level memory corruption, administrators should prioritize updating affected Linux kernels to the specified fixed versions. Given the potential for system-wide impact and the lack of complex requirements for triggering the flaw, immediate patching is strongly recommended to maintain system integrity and stability.

More Linux CVEs

Sources