CVE-2026-64168 Overview
CVE-2026-64168 is a Linux kernel vulnerability in the Spreadtrum (sprd) SPI driver. The driver falls back to Programmed I/O (PIO) mode when Direct Memory Access (DMA) setup fails during probe. However, late probe error paths do not check the dma.enabled flag before releasing DMA channels. This results in dereferencing an error pointer or attempting to release a DMA channel a second time. The issue was flagged during review of a devres allocation conversion patch. The fix ensures the dma.enabled flag is checked prior to releasing DMA channels on error paths.
Critical Impact
Local triggering of the faulty error path can lead to kernel instability or crash via error pointer dereference in the SPI subsystem.
Affected Products
- Linux kernel — spi-sprd driver (Spreadtrum SPI controller)
- Multiple stable branches referenced by upstream kernel commits
- Systems using Spreadtrum SoCs with SPI DMA configuration
Discovery Timeline
- 2026-07-19 - CVE-2026-64168 published to NVD
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-64168
Vulnerability Analysis
The vulnerability resides in the spi-sprd driver, which supports the Spreadtrum SPI controller in the Linux kernel. During device probe, the driver attempts to configure DMA channels. If DMA setup fails, the driver falls back to PIO mode and continues operation without DMA. The dma.enabled flag records whether DMA was successfully initialized.
The defect occurs on late probe error paths. Cleanup code attempts to release DMA channels without first verifying that dma.enabled is true. When DMA setup failed earlier, the channel pointers hold error values returned by dma_request_chan() rather than valid channel handles. Releasing them dereferences the error pointer.
A secondary issue is double-release of DMA channels along overlapping cleanup paths. Both conditions can trigger a kernel oops in the SPI subsystem during driver initialization.
Root Cause
The root cause is missing state validation in the driver's error unwind logic [Null Pointer Dereference / error pointer misuse]. The cleanup routine assumed DMA channels were always valid when reached, ignoring the PIO fallback path. Without checking dma.enabled, the code treats ERR_PTR values as valid struct dma_chan pointers.
Attack Vector
The defective path is reached only through kernel probe failures on the spi-sprd driver. Triggering the flaw requires the DMA subsystem to fail during driver initialization followed by a subsequent late probe error. This is primarily a reliability defect exploitable locally on affected Spreadtrum-based hardware where a user or attacker can influence probe conditions. There is no known remote attack surface.
No public proof-of-concept exists. The vulnerability was identified through code review during a devres conversion patch. Fix commits are available in the Kernel Git Commit c33b4496 and related stable backports.
Detection Methods for CVE-2026-64168
Indicators of Compromise
- Kernel oops or panic messages referencing spi-sprd or sprd_spi symbols in dmesg output
- Stack traces containing dma_release_channel invoked from SPI probe error paths
- Repeated probe failures for Spreadtrum SPI devices at boot time
Detection Strategies
- Audit kernel version and confirm whether the spi-sprd driver is compiled and loaded on affected devices
- Review boot logs for messages indicating DMA setup failure followed by SPI probe errors
- Correlate kernel crash dumps with the fixing commits in the Linux stable tree
Monitoring Recommendations
- Forward kernel logs to a centralized logging platform and alert on spi-sprd probe failures
- Track kernel package versions across the fleet and flag hosts on pre-patch releases
- Monitor for unexpected reboots on Spreadtrum SoC devices, which may indicate the probe-time oops
How to Mitigate CVE-2026-64168
Immediate Actions Required
- Identify hosts running kernels containing the vulnerable spi-sprd driver
- Apply the upstream fix or vendor-supplied kernel update that adds the dma.enabled check before releasing DMA channels
- Reboot affected systems after installing the patched kernel to activate the fix
Patch Information
The fix has been merged into the mainline Linux kernel and backported to multiple stable branches. Reference commits include Kernel Git Commit 0cdea166, Kernel Git Commit 3d67fffb, Kernel Git Commit 450c319d, Kernel Git Commit a8f233fb, Kernel Git Commit b6f1acf4, Kernel Git Commit be409d2b, Kernel Git Commit be74e276, and Kernel Git Commit c33b4496.
Workarounds
- Disable the spi-sprd driver if the affected SPI controller is not required on the platform
- Avoid configurations that force DMA setup failure during probe, when hardware permits
- Pin systems to a known-good kernel release until vendor patches can be tested and deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
