CVE-2026-31560: Linux Kernel SPI DMA DoS Vulnerability

CVE-2026-31560 Overview

CVE-2026-31560 is a null pointer dereference vulnerability in the Linux kernel's SPI DesignWare DMA driver (spi-dw-dma). The vulnerability occurs during error handling in DMA transaction processing, where the driver attempts to access a potentially null current message pointer. When an error condition occurs during SPI DMA transactions, the device may not have a current message available, and attempting to access this null pointer causes a system crash.

Critical Impact
Local attackers with low privileges can trigger a denial of service condition, causing the system to crash and become unavailable.

Affected Products

Linux Kernel 5.8 and later versions
Linux Kernel 7.0 Release Candidates (rc1 through rc7)
Linux Kernel (various versions with spi-dw-dma driver)

Discovery Timeline

April 24, 2026 - CVE-2026-31560 published to NVD
April 27, 2026 - Last updated in NVD database

Technical Details for CVE-2026-31560

Vulnerability Analysis

This vulnerability exists in the Linux kernel's SPI DesignWare DMA subsystem, specifically in the error logging mechanism during transaction wait operations. The root of the issue lies in the driver's attempt to access the device structure through the current SPI message pointer without first verifying that the pointer is valid.

When a DMA transaction error occurs, the error handling code path attempts to log diagnostic information. The problematic code attempts to dereference ctlr->cur_msg to access the device structure for error logging purposes. However, under certain error conditions, the current message may not exist (i.e., the pointer is null), leading to a null pointer dereference when the code attempts to use this structure.

The vulnerability can be exploited locally by a user with low privileges, potentially by triggering specific error conditions in SPI DMA transactions that cause the current message to be unavailable during error handling.

Root Cause

The root cause is improper null pointer validation in the error logging code path of the spi-dw-dma driver. When waiting for a DMA transaction to finish and an error occurs, the driver assumes that a current message (cur_msg) always exists and uses it to obtain the device structure for logging. The fix involves using the device structure directly from the struct spi_controller (ctlr) rather than dereferencing through the potentially null current message pointer.

Attack Vector

This vulnerability requires local access to the system. An attacker with low-level privileges could potentially trigger the vulnerability by:

Interacting with SPI devices that use the DesignWare DMA driver
Inducing error conditions during SPI DMA transactions
Causing the driver to enter the error handling code path when no current message exists

The vulnerability does not require user interaction and, while it cannot compromise confidentiality or integrity, it results in high availability impact through system crashes.

The fix modifies the error logging to use &ctlr->dev instead of &ctlr->cur_msg->spi->dev, ensuring a valid device structure is always available for error reporting regardless of the current message state.

Detection Methods for CVE-2026-31560

Indicators of Compromise

Kernel panic or crash logs indicating null pointer dereference in spi-dw-dma related functions
System instability or unexpected reboots when SPI DMA transactions are in use
Crash dump analysis showing fault addresses within the SPI DesignWare DMA driver code path

Detection Strategies

Monitor kernel logs (dmesg, /var/log/kern.log) for SPI-related error messages and null pointer dereference warnings
Implement kernel crash dump analysis to identify crashes originating from the spi-dw-dma module
Use kernel debugging tools like kdump or crash to analyze any system crashes for signs of this vulnerability

Monitoring Recommendations

Enable kernel crash dump collection to capture diagnostic information if the vulnerability is triggered
Monitor SPI device activity and error rates on systems using DesignWare DMA-based SPI controllers
Implement alerting for unexpected system reboots or kernel panics in production environments

How to Mitigate CVE-2026-31560

Immediate Actions Required

Apply the latest Linux kernel security patches that address CVE-2026-31560
Prioritize patching systems that actively use SPI DesignWare DMA controllers
Review system configurations to identify affected kernel versions
Consider temporary isolation of systems with vulnerable configurations until patches can be applied

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability. The fix modifies the error logging code to use the device structure from struct spi_controller directly rather than through the current message pointer, preventing the null pointer dereference.

Patches are available through the official kernel git repositories:

Update to the latest stable kernel version that includes these commits to remediate the vulnerability.

Workarounds

If immediate patching is not possible, consider disabling or limiting access to SPI devices using the DesignWare DMA driver
Restrict local user access to systems with vulnerable configurations
Monitor system stability and implement automatic restart procedures to minimize downtime from potential crashes

bash

# Check current kernel version
uname -r

# Update kernel to latest patched version (Debian/Ubuntu)
sudo apt update && sudo apt upgrade linux-image-generic

# Update kernel to latest patched version (RHEL/CentOS)
sudo yum update kernel

# Verify the spi-dw-dma module is loaded
lsmod | grep spi_dw