CVE-2026-64221
Description
A flaw was found in the spi: ti-qspi component of the Linux kernel. This use-after-free vulnerability occurs when the driver attempts to fall back to PIO mode after a Direct Memory Access (DMA) setup failure during probe. If the DMA channel pointer is not properly cleared after a buffer allocation failure, it can lead to the use of a freed memory region. This could allow a local attacker to cause a denial of service or potentially escalate privileges.
Statement
An IMPORTANT severity use-after-free flaw was found in the Linux kernel spi: ti-qspi (Texas Instruments Quad SPI) driver. During driver probe, if DMA setup fails the driver falls back to PIO mode; however, if the subsequent buffer allocation also fails, the DMA channel pointer is not cleared. As a result, a pointer to an already-released DMA channel can be passed to the DMA engine, or the channel can be freed a second time on late probe errors or driver unbind, resulting in a use-after-free. A local attacker with limited privileges who can trigger this error path could use this flaw to crash the kernel (denial of service) or potentially escalate privileges. Red Hat rates this flaw CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), lower than the upstream CVEORG score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), because successful exploitation requires a specific and complex sequence of DMA setup and buffer allocation failures during probe. All Red Hat Enterprise Linux (kernel and kernel-rt) and Red Hat In-Vehicle OS kernel streams currently listed in this flaw are marked NOT AFFECTED because the vulnerable code is not present in the shipped kernel versions.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | High | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
