CVE-2026-64169: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64169 Overview

CVE-2026-64169 is a Linux kernel vulnerability in the spi-ep93xx driver. The driver falls back to Programmed I/O (PIO) mode when Direct Memory Access (DMA) setup fails during probe. It does not clear the DMA channel pointers after this failure, leaving stale error pointers in the driver state. Subsequent probe error paths or driver unbind operations then dereference these error pointers, leading to a kernel crash. The issue was flagged during review of a devres allocation conversion patch and has been fixed across multiple stable kernel branches.

Critical Impact
Local triggering of an error pointer dereference in the SPI ep93xx driver can cause a kernel oops, resulting in denial of service on affected systems.

Affected Products

Linux kernel builds including the spi-ep93xx SPI controller driver
Systems using Cirrus Logic EP93xx ARM-based SoCs with SPI peripherals
Stable kernel branches prior to the commits referenced in the kernel.org advisories

Discovery Timeline

2026-07-19 - CVE-2026-64169 published to the National Vulnerability Database (NVD)
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64169

Vulnerability Analysis

The vulnerability resides in the Serial Peripheral Interface (SPI) driver for the Cirrus Logic EP93xx platform, located in the Linux kernel SPI subsystem. During driver initialization, the probe function attempts to allocate DMA channels for high-throughput SPI transfers. When DMA setup fails, the driver is designed to gracefully fall back to PIO mode so that SPI functionality remains available.

The defect is that the DMA channel pointer fields are not reset after the failed setup. Kernel DMA allocation helpers return ERR_PTR-encoded error values rather than NULL on failure. When later probe error handling or the driver unbind path executes cleanup logic, it treats the encoded error value as a valid pointer and dereferences it. This produces an invalid memory access and a kernel oops.

Root Cause

The root cause is a missing state reset after partial initialization failure. The fallback code path preserves the ERR_PTR values returned by the DMA request helpers in the driver's channel pointer fields. Cleanup routines check these fields for validity using NULL comparisons rather than IS_ERR(), so they incorrectly proceed to release the encoded error value. This class of defect is a null pointer or invalid pointer dereference tied to improper error handling.

Attack Vector

The defect is triggered locally through driver lifecycle events on hardware that exercises the ep93xx SPI controller. Reaching the vulnerable code path requires DMA setup to fail during probe, followed by a subsequent probe error or a driver unbind event. Exploitability is limited to denial of service on affected hardware and does not provide a remote attack surface.

No verified proof-of-concept code is available. The vulnerability mechanism is described in the upstream kernel commits referenced in the kernel.org stable tree.

Detection Methods for CVE-2026-64169

Indicators of Compromise

Kernel oops or panic messages referencing spi-ep93xx in dmesg or the system journal
Stack traces containing ep93xx_spi_remove or DMA channel release symbols after a failed probe
Repeated probe failures for the ep93xx SPI controller followed by driver unbind attempts

Detection Strategies

Inventory running kernel versions across EP93xx-based devices and compare against the fixed commits in the stable tree
Parse kernel ring buffer logs for BUG: or Oops: entries that reference SPI driver symbols
Include the fixing commit hashes (0e2189ab095e, 5e121a81667a, 8e027db9fa31, b6c0dabea07e) in configuration baselines for embedded Linux fleets

Monitoring Recommendations

Forward kernel logs from embedded EP93xx systems to a centralized log platform for anomaly review
Alert on unexpected kernel oops events on devices that use the SPI subsystem
Track driver bind and unbind events on production hardware to identify systems exposed to the faulty error path

How to Mitigate CVE-2026-64169

Immediate Actions Required

Update affected Linux systems to a kernel version that includes the upstream fix commits referenced in the NVD advisory
Rebuild custom or vendor kernels for EP93xx platforms with the backported patch applied
Avoid programmatic unbind operations against the spi-ep93xx driver on unpatched kernels

Patch Information

Four upstream commits address the issue by clearing the DMA channel pointers when DMA setup fails, ensuring later cleanup paths do not dereference an ERR_PTR value. The patches are available in the kernel stable tree: commit 0e2189ab095e, commit 5e121a81667a, commit 8e027db9fa31, and commit b6c0dabea07e. Distribution maintainers should backport these changes to supported long-term stable kernels.

Workarounds

Ensure DMA controllers required by the SPI driver are correctly declared in the device tree so DMA setup succeeds during probe
Restrict use of sysfs unbind interfaces on the spi-ep93xx driver until patched kernels are deployed
Where feasible, deploy kernels built without the spi-ep93xx module on hardware that does not require this SPI controller

bash

# Verify current kernel version and check for the ep93xx SPI driver
uname -r
modinfo spi-ep93xx | grep -E '^(filename|version|srcversion)'

# Confirm the fix commit is present in the kernel source tree
git -C /usr/src/linux log --oneline | grep -E '0e2189ab095e|5e121a81667a|8e027db9fa31|b6c0dabea07e'