CVE-2026-46148 Overview
CVE-2026-46148 is a Linux kernel vulnerability in the microchip-core-qspi SPI driver. The coreQSPI intellectual property (IP) block supports a single hardware-managed chip select (CS). The hardware drives that CS low when the transmit buffer is written and high once the bytes recorded in the TOTALBYTES field of the FRAMES register have been transmitted. Additional peripherals on the same bus must rely on general-purpose input/output (GPIO) lines for their chip selects. When two devices share the controller, the built-in CS asserts low while Linux accesses the GPIO-selected device, corrupting bus arbitration. The kernel maintainers resolved the issue by switching the driver to control CS directly through a set_cs callback.
Critical Impact
Concurrent access to multiple SPI peripherals can cause incorrect chip-select assertion, producing data corruption on the QSPI bus.
Affected Products
- Linux kernel branches containing the microchip-core-qspi SPI driver
- Microchip PolarFire SoC platforms exposing the coreQSPI IP
- Embedded boards multiplexing the coreQSPI controller across multiple SPI devices
Discovery Timeline
- 2026-05-28 - CVE-2026-46148 published to NVD
- 2026-05-28 - Last updated in NVD database
Technical Details for CVE-2026-46148
Vulnerability Analysis
The coreQSPI controller exposes one hardware-managed chip select. The hardware asserts the line low when transfer data is written and deasserts it once TOTALBYTES of the FRAMES register have been clocked out. Any additional peripheral on the controller must be selected through a GPIO line. The driver did not override this automagic behavior, so the built-in CS toggled low during transactions targeted at GPIO-selected devices on the same bus. The auto-managed CS also asserts active-low only, preventing correct operation of active-high peripherals or transfers that need CS deasserted during clocking.
Root Cause
The original driver delegated chip-select handling entirely to the hardware state machine. It also reconfigured the CLKIDLE, MASTER, and ENABLE fields inside the per-device mchp_coreqspi_setup_op() callback. Changing CLKIDLE while another device was mid-transfer was unsafe, and the lack of a set_cs implementation meant the SPI core could not coordinate CS state across devices sharing the controller.
Attack Vector
This flaw is a functional kernel defect rather than a remotely reachable security boundary issue. It manifests on hardware configurations that attach multiple SPI peripherals to the coreQSPI controller. The fix implements an explicit set_cs callback for regular transfers, retains full-transfer CS assertion for mem_ops in the exec_op callback, removes mchp_coreqspi_setup_op(), and initializes MASTER and ENABLE once at probe. The new setup callback also drives the built-in CS to its inactive state for active-low devices because the reset value in software-controlled mode is low. See Kernel Git Commit 7672749, Kernel Git Commit 998f431, and Kernel Git Commit ee3c99a for the upstream patches.
Detection Methods for CVE-2026-46148
Indicators of Compromise
- Unexpected SPI transaction failures or read/write inconsistencies on boards using the coreQSPI controller with multiple devices.
- Kernel log entries reporting CRC or framing errors from drivers bound to GPIO-selected SPI peripherals downstream of microchip-core-qspi.
- Device probe failures for secondary SPI devices when the primary device on the built-in CS is also active.
Detection Strategies
- Audit kernel build configuration and running kernel version against the patched commits referenced in the upstream advisory.
- Inspect device tree definitions for coreQSPI controllers with more than one child node and confirm GPIO cs-gpios entries are present and respected.
- Compare deployed driver source against the upstream microchip-core-qspi driver to verify the presence of a set_cs callback.
Monitoring Recommendations
- Track kernel build provenance for Microchip PolarFire SoC images and alert on builds lacking the referenced fix commits.
- Monitor dmesg output during boot for repeated SPI transfer retries originating from the coreQSPI subsystem.
- Maintain an inventory of embedded assets running affected kernel versions to prioritize firmware refresh cycles.
How to Mitigate CVE-2026-46148
Immediate Actions Required
- Update affected Linux kernel images to a release containing commits 7672749, 998f431, or ee3c99a for the microchip-core-qspi driver.
- Verify device tree configurations declare explicit cs-gpios entries for every non-primary peripheral on the coreQSPI bus.
- Rebuild and redeploy firmware for PolarFire SoC boards that share the coreQSPI controller across multiple SPI devices.
Patch Information
The Linux kernel maintainers published three upstream commits resolving the issue: Kernel Git Commit 7672749, Kernel Git Commit 998f431, and Kernel Git Commit ee3c99a. The patches refactor chip-select handling, remove unsafe runtime reconfiguration of CLKIDLE, and move MASTER and ENABLE initialization to probe.
Workarounds
- Restrict the coreQSPI controller to a single SPI device until patched kernels are deployed.
- Avoid mixing GPIO-selected and built-in-CS peripherals on the same coreQSPI bus on unpatched systems.
- Use only active-low devices when the built-in CS is required, since the legacy driver cannot drive an active-high line correctly.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
