SB20260816400 - Improper Initialization in Linux kernel spi driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Initialization (CVE-ID: CVE-2026-72134)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause data corruption.

The vulnerability exists due to improper state management in the spi-imx ECSPI transfer handling when falling back from DMA to PIO after DMA descriptor preparation fails. A local user can trigger a transfer that falls back to PIO to cause data corruption.

This can occur on systems where ECSPI DMA is described but DMA descriptor preparation fails, causing the controller to continue the transfer with DMA-mode settings still applied.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/245404c26563aafb36aafb01298f148db1851be3
• https://git.kernel.org/stable/c/40dee2d3e9994aed9efe7bed40eb0e4d38d5a25c