Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2026-23202

spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer

Summary

spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer

Original description

The description as published by the source.

In the Linux kernel, the following vulnerability has been resolved:

spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer

The curr_xfer field is read by the IRQ handler without holding the lock
to check if a transfer is in progress. When clearing curr_xfer in the
combined sequence transfer loop, protect it with the spinlock to prevent
a race with the interrupt handler.

Protect the curr_xfer clearing at the exit path of
tegra_qspi_combined_seq_xfer() with the spinlock to prevent a race
with the interrupt handler that reads this field.

Without this protection, the IRQ handler could read a partially updated
curr_xfer value, leading to NULL pointer dereference or use-after-free.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Linux Kernel
[{"type":"ECOSYSTEM","events":[{"introduced":"5.15.198"},{"fixed":"5.15.200"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.1.160"},{"fixed":"6.1.163"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.6.120"},{"fixed":"6.6.124"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.12.63"},{"fixed":"6.12.70"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.18.2"},{"fixed":"6.18.10"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details