{"id":"CVE-2026-64303","revision":"0777211f5b504bbcba6dc92d1955ea56","records":[{"revision":"0777211f5b504bbcba6dc92d1955ea56","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-64303","aliases":[],"title":"spi: fsl-lpspi: terminate the RX channel on TX prepare failure path","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: fsl-lpspi: terminate the RX channel on TX prepare failure path\n\nWhen dmaengine_prep_slave_sg() fails for the TX channel, the error path\nterminates the TX DMA channel but leaves the RX channel running. Since\nthe RX channel was already submitted and issued prior to preparing\nthe TX descriptor, returning -EINVAL causes the SPI core to unmap the\nDMA buffers while the RX DMA engine continues writing to them, leading\nto potential memory corruption or use-after-free.\n\nTerminate the RX channel before returning on the TX prepare failure path.","state":0,"publishedAt":"2026-07-25T08:49:38.223+00:00","modifiedAt":"2026-10-19T20:38:22.841+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/spi/spi-fsl-lpspi.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"09c04466ce7ea494993c0635ba5edb6d2222a806\",\n                            \"lessThan\": \"ad370d1c7a9a832f77b2341513cd31188c9443af\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"09c04466ce7ea494993c0635ba5edb6d2222a806\",\n                            \"lessThan\": \"cce2063404b2341e7b2bbf85eddfcd70a31a0033\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"09c04466ce7ea494993c0635ba5edb6d2222a806\",\n                            \"lessThan\": \"af39a2698f69b584d14a00cffe0f51a2caa15337\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"09c04466ce7ea494993c0635ba5edb6d2222a806\",\n                            \"lessThan\": \"e65505d91fa036a238968e4c10744244d1b968c4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"09c04466ce7ea494993c0635ba5edb6d2222a806\",\n                            \"lessThan\": \"d5c1060218a3749c8a18b36f8169d910fce20639\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"09c04466ce7ea494993c0635ba5edb6d2222a806\",\n                            \"lessThan\": \"808033d80d5c9f8adf7e8de9317389270ce13430\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"09c04466ce7ea494993c0635ba5edb6d2222a806\",\n                            \"lessThan\": \"9d000bdd250d649a11cd7f733175686877344582\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"09c04466ce7ea494993c0635ba5edb6d2222a806\",\n                            \"lessThan\": \"01980b5da56e573d62798d0ff6c86bcaa2b22cbe\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/spi/spi-fsl-lpspi.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.2\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.2\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.261\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.212\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.178\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.145\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.96\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.39\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.4\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://git.kernel.org/stable/c/ad370d1c7a9a832f77b2341513cd31188c9443af","https://git.kernel.org/stable/c/cce2063404b2341e7b2bbf85eddfcd70a31a0033","https://git.kernel.org/stable/c/af39a2698f69b584d14a00cffe0f51a2caa15337","https://git.kernel.org/stable/c/e65505d91fa036a238968e4c10744244d1b968c4","https://git.kernel.org/stable/c/d5c1060218a3749c8a18b36f8169d910fce20639","https://git.kernel.org/stable/c/808033d80d5c9f8adf7e8de9317389270ce13430","https://git.kernel.org/stable/c/9d000bdd250d649a11cd7f733175686877344582","https://git.kernel.org/stable/c/01980b5da56e573d62798d0ff6c86bcaa2b22cbe"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64303","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-64303","identifiers":["CVE-2026-64303"]},"retained":false,"historicalAffected":[]}],"coverage":[]}