CVE-2026-46203: Linux Kernel SPI Cadence Vulnerability

CVE-2026-46203 Overview

CVE-2026-46203 affects the Linux kernel spi-cadence-quadspi driver. The vulnerability stems from an unclocked register access during driver unbind. The controller could be disabled without being runtime resumed, leading to register operations executed while the device clock was gated. The issue was flagged during review of a controller deregistration fix. The upstream patch ensures the controller is runtime resumed before being disabled at unbind time.

Critical Impact

Unclocked hardware register access during driver unbind can produce undefined behavior, bus errors, or system instability on platforms using the Cadence Quad SPI controller.

Affected Products

• Linux kernel spi-cadence-quadspi driver
• Systems integrating Cadence Quad SPI controllers managed by this driver
• Stable kernel branches receiving the backported fix

Discovery Timeline

• 2026-05-28 - CVE-2026-46203 published to NVD
• 2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46203

Vulnerability Analysis

The spi-cadence-quadspi driver disables the controller during the unbind path. The unbind handler did not ensure that runtime power management had resumed the device before touching controller registers. When the device was already runtime-suspended, its clocks were gated. Accessing memory-mapped registers without an active clock results in undefined hardware behavior on many SoCs and can trigger a bus error or hang.

The defect sits in the driver teardown sequence rather than in any data path exposed to userspace. It is a kernel-side correctness flaw in lifecycle management of a peripheral controller. Triggering the condition requires the driver to be unbound while the controller is runtime-suspended, which typically occurs through administrative actions such as module removal or sysfs unbind.

Root Cause

The driver invoked controller-disable register writes without calling pm_runtime_get_sync() or an equivalent resume primitive first. With runtime power management enabled and the device idle, the clock supplying the register block was disabled. Writing to a clock-gated register block is the root cause of the unclocked access flagged by the reviewer.

Attack Vector

This is a local, kernel-side reliability issue. Triggering it requires privileged operations such as unbinding the driver or removing the module while the controller is runtime-suspended. There is no documented remote attack path and no evidence of exploitation. The practical impact is limited to system stability on hardware using the affected controller.

No verified exploitation code is published. Refer to the upstream commits Kernel Git Commit 233db2c and Kernel Git Commit d67a531 for the exact source changes.

Detection Methods for CVE-2026-46203

Indicators of Compromise

• Kernel log entries referencing bus errors, synchronous external aborts, or hangs originating from the spi-cadence-quadspi driver during module removal or device unbind
• Unexpected oops or warning traces in dmesg that include cqspi or cadence_qspi symbols within the unbind path

Detection Strategies

• Audit running kernel versions across Linux fleets and compare against the patched stable releases referenced in the upstream commits
• Review change-management records for driver unbind or module unload events on devices that expose Cadence Quad SPI controllers
• Monitor for repeated kernel panics or device resets correlated with spi-cadence-quadspi module operations

Monitoring Recommendations

• Forward dmesg and journald kernel logs to a central log platform and alert on faults referencing cqspi
• Track package and kernel versions through configuration management to confirm patch deployment
• Include kernel-version inventory checks in periodic vulnerability scans on embedded and edge devices

How to Mitigate CVE-2026-46203

Immediate Actions Required

• Apply the upstream patches referenced by commits 233db2cb14db8b1935dda52a6affd97276462b82 and d67a5311818b3e6481a1e4293c9337ebfee73111 or upgrade to a stable kernel release containing the fix
• Avoid unbinding or removing the spi-cadence-quadspi driver on production systems until the patch is installed
• Restrict access to root-equivalent operations that can unbind kernel drivers or unload modules

Patch Information

The fix ensures the controller is runtime resumed before it is disabled during driver unbind. The change is available in the Linux stable tree via Kernel Git Commit 233db2c and Kernel Git Commit d67a531. Distribution kernels will inherit the fix once they sync to a stable point release that includes these commits.

Workarounds

• Do not perform echo <device> > /sys/bus/platform/drivers/cadence-qspi/unbind operations on unpatched kernels
• Disable runtime power management for the affected controller until the patched kernel is deployed, accepting the resulting power cost
• Keep the module loaded for the lifetime of the system on hosts where the controller is required

# Verify the running kernel and check for the fix commit in the source tree
uname -r
git -C /usr/src/linux log --oneline | grep -E '233db2c|d67a531'