CVE-2026-64170: Linux Kernel SPI QUP DMA Vulnerability

CVE-2026-64170 Overview

CVE-2026-64170 is a Linux kernel vulnerability in the Qualcomm Universal Peripheral (QUP) Serial Peripheral Interface (SPI) driver. The driver falls back to Programmed I/O (PIO) mode when Direct Memory Access (DMA) setup fails during probe. However, it fails to clear the DMA channel pointers after setup failure. This leaves stale error pointers in place that can later be dereferenced during subsequent probe errors or driver unbind operations.

The issue was flagged by a reviewer named Sashiko while reviewing a devres allocation conversion patch. It has been resolved upstream in the Linux kernel.

Critical Impact
Local triggering of an error pointer dereference in the SPI QUP driver can lead to kernel crashes or attempts to release a DMA channel twice, resulting in a denial of service condition on affected Qualcomm-based Linux systems.

Affected Products

Linux kernel spi-qup driver on Qualcomm SoC platforms
Stable and mainline Linux kernel trees prior to the fix commits
Distributions shipping vulnerable kernels on Qualcomm hardware

Discovery Timeline

2026-07-19 - CVE-2026-64170 published to the National Vulnerability Database (NVD)
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64170

Vulnerability Analysis

The vulnerability resides in the spi-qup driver, which manages SPI controllers on Qualcomm platforms. During probe, the driver attempts to configure DMA channels for high-throughput SPI transfers. When DMA setup fails, the driver gracefully falls back to PIO mode so the controller remains usable.

The fallback path does not reset the DMA channel pointers to NULL. Instead, the pointers retain the ERR_PTR() values returned by the failed allocation helpers. Later code paths, including additional probe error handling and driver unbind, check these pointers with tests such as if (ptr) rather than IS_ERR_OR_NULL(ptr). Those paths then dereference the error pointer or invoke channel release functions on an already-invalid handle.

The result is either a kernel oops from dereferencing a low-numbered error address or a double release of a DMA channel resource. Both outcomes destabilize the kernel. This class of bug maps to [CWE-476] Null Pointer Dereference variants and improper error state handling.

Root Cause

The root cause is incomplete cleanup of driver state after a partial initialization failure. The spi-qup probe routine treats DMA setup as optional but does not normalize the channel pointer state when transitioning to PIO fallback. Subsequent code assumes the pointer is either a valid channel or NULL, an invariant the fallback path violates.

Attack Vector

Exploitation requires local access to a system running an affected kernel on Qualcomm hardware. A privileged actor able to trigger driver unbind through sysfs, module removal, or repeated probe failures can force the kernel to dereference the stale error pointer. The vulnerability is not remotely reachable and does not provide a code execution primitive. Impact is limited to kernel instability and denial of service.

See the upstream fix in Kernel Git Commit 0bb3bd442f0b for the exact source-level change that clears the DMA channel pointers on setup failure.

Detection Methods for CVE-2026-64170

Indicators of Compromise

Kernel oops or panic messages referencing spi_qup, dma_release_channel, or IS_ERR addresses in dmesg
Repeated probe failures for the spi-qup driver followed by kernel warnings during device unbind
Unexpected SPI bus outages on Qualcomm platforms after module reload cycles

Detection Strategies

Query installed kernel versions across Linux fleets and compare against the fixed commits listed on git.kernel.org
Parse /var/log/kern.log and journalctl -k output for spi-qup errors and DMA channel release failures
Use configuration management to enumerate systems where CONFIG_SPI_QUP=y or the module is loaded

Monitoring Recommendations

Forward kernel logs to a central logging platform and alert on Oops, BUG, or WARN entries in SPI subsystem code paths
Track kernel package versions in inventory tooling to confirm patch deployment
Monitor Qualcomm-based embedded and mobile Linux endpoints for unexpected reboots correlated with SPI activity

How to Mitigate CVE-2026-64170

Immediate Actions Required

Identify Linux systems running Qualcomm SoCs with the spi-qup driver enabled
Apply the upstream stable kernel update that contains the fix commits referenced by the NVD entry
Restrict local privileged access to systems that cannot yet be patched, since triggering the bug requires local capabilities such as driver unbind

Patch Information

The fix has been merged into the mainline Linux kernel and backported to multiple stable branches. Relevant commits include Kernel Git Commit 0bb3bd442f0b, Kernel Git Commit 45760b72e84c, Kernel Git Commit 4bb4764f2c51, Kernel Git Commit 4f4051e9d644, Kernel Git Commit 8f9b61d255b1, Kernel Git Commit 9e673affb92c, Kernel Git Commit a7e8f3efd50a, and Kernel Git Commit d577c55d189e. Consume the fix through your distribution's kernel update channel.

Workarounds

Avoid unbinding or reloading the spi-qup module on affected kernels, since the dereference triggers during unbind and repeated probe failures
Where feasible, blacklist the spi-qup module on systems that do not require SPI functionality until a patched kernel is deployed
Limit local shell access and CAP_SYS_MODULE privileges to reduce the population of users able to induce probe or unbind cycles

bash

# Verify running kernel version and check for the spi-qup module
uname -r
lsmod | grep spi_qup

# Inspect kernel log for SPI QUP related warnings
dmesg | grep -iE 'spi[-_]qup|dma_request_chan|dma_release_channel'

# After updating packages, reboot into the patched kernel
sudo apt-get update && sudo apt-get upgrade -y linux-image-$(uname -r | cut -d- -f2-)
sudo reboot