{
  "threat_severity" : "Moderate",
  "public_date" : "2026-02-14T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: spi: tegra210-quad: Protect curr_xfer check in IRQ handler",
    "id" : "2439897",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2439897"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
    "status" : "draft"
  },
  "cwe" : "CWE-367",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nspi: tegra210-quad: Protect curr_xfer check in IRQ handler\nNow that all other accesses to curr_xfer are done under the lock,\nprotect the curr_xfer NULL check in tegra_qspi_isr_thread() with the\nspinlock. Without this protection, the following race can occur:\nCPU0 (ISR thread)              CPU1 (timeout path)\n----------------               -------------------\nif (!tqspi->curr_xfer)\n// sees non-NULL\nspin_lock()\ntqspi->curr_xfer = NULL\nspin_unlock()\nhandle_*_xfer()\nspin_lock()\nt = tqspi->curr_xfer  // NULL!\n... t->len ...        // NULL dereference!\nWith this patch, all curr_xfer accesses are now properly synchronized.\nAlthough all accesses to curr_xfer are done under the lock, in\ntegra_qspi_isr_thread() it checks for NULL, releases the lock and\nreacquires it later in handle_cpu_based_xfer()/handle_dma_based_xfer().\nThere is a potential for an update in between, which could cause a NULL\npointer dereference.\nTo handle this, add a NULL check inside the handlers after acquiring\nthe lock. This ensures that if the timeout path has already cleared\ncurr_xfer, the handler will safely return without dereferencing the\nNULL pointer.", "A race condition was found in the Tegra210 Quad SPI driver's IRQ handler. The curr_xfer pointer is checked for NULL without holding the spinlock, but can be set to NULL by the timeout path between the check and subsequent use, leading to a NULL pointer dereference when accessing t->len." ],
  "statement" : "This vulnerability affects NVIDIA Tegra210-based systems using the Quad SPI controller. The race requires precise timing between the ISR thread and timeout handling, making it difficult to trigger but causing a kernel crash when it occurs.",
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-23207\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23207\nhttps://lore.kernel.org/linux-cve-announce/2026021438-CVE-2026-23207-a80c@gregkh/T" ],
  "name" : "CVE-2026-23207",
  "csaw" : false
}