CVE-2026-64221 Overview
CVE-2026-64221 is a use-after-free vulnerability in the Linux kernel's spi/ti-qspi driver. The driver falls back to Programmed I/O (PIO) mode when Direct Memory Access (DMA) setup fails during probe. If buffer allocation subsequently fails, the driver does not clear the DMA channel pointer, leaving a dangling reference to a released channel. This dangling pointer can be passed to the DMA engine or freed a second time on late probe errors or driver unbind. The issue was flagged by Sashiko during review of a devres allocation conversion patch. Multiple stable kernel branches received corresponding fixes.
Critical Impact
A local attacker with the ability to trigger driver probe or unbind paths on affected hardware can leverage the dangling DMA channel pointer for memory corruption, potentially leading to privilege escalation or kernel crash.
Affected Products
- Linux kernel spi-ti-qspi driver (Texas Instruments QSPI controller)
- Stable kernel branches referenced by fix commits 178b9b5, 1cd9270, 3bbbe7a, 9c6f306, d6f422b, d7a076f, ea6ec33, f2dc841
- Systems using TI QSPI hardware where DMA setup can fail at probe time
Discovery Timeline
- 2026-07-24 - CVE-2026-64221 published to the National Vulnerability Database (NVD)
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-64221
Vulnerability Analysis
The spi-ti-qspi driver initializes a DMA channel during probe to accelerate Serial Peripheral Interface (SPI) transfers. When DMA setup fails, the driver deliberately downgrades to PIO mode so the device remains functional. The downgrade logic did not fully release DMA-related state on all error paths, leaving a stale channel pointer inside the driver's per-device structure.
Specifically, if the DMA channel is obtained successfully but the subsequent buffer allocation fails, the driver releases the channel without clearing the stored pointer. Later code paths — including runtime submission to the DMA engine, late probe error unwinding, or driver unbind — dereference or re-free the released channel. This is a classic use-after-free condition [CWE-416] combined with a potential double-free [CWE-415].
Root Cause
The root cause is incomplete cleanup on a partial-failure path. The driver frees the DMA channel resource but retains a non-NULL pointer to that resource. Because subsequent code checks the pointer for non-NULL to decide whether to interact with the DMA engine or free the channel, the released object is accessed again.
Attack Vector
Exploitation requires local access on a system with TI QSPI hardware and the ability to influence probe or unbind of the driver. The CVSS vector indicates local attack vector with low privileges required. Triggering the vulnerable path depends on inducing a DMA buffer allocation failure or repeated bind/unbind cycles. Successful exploitation impacts confidentiality, integrity, and availability of the kernel.
No public proof-of-concept exploit code is available. See the referenced kernel commits for the exact source-level fix.
Detection Methods for CVE-2026-64221
Indicators of Compromise
- Kernel oops or panic entries in dmesg referencing ti_qspi, dma_release_channel, or slab use-after-free reports
- KASAN (Kernel Address Sanitizer) reports flagging use-after-free in the spi-ti-qspi module
- Repeated bind/unbind operations against the TI QSPI driver in audit logs
Detection Strategies
- Enable KASAN on test kernels to catch use-after-free access to freed DMA channel objects
- Inventory kernel versions across TI-based embedded and edge devices and cross-reference against the fix commits listed in the NVD advisory
- Monitor for unexpected module load, unload, or device rebind events on affected hardware
Monitoring Recommendations
- Forward kernel logs to a centralized logging platform and alert on BUG:, KASAN, or general protection fault entries referencing ti-qspi
- Track patch state of Linux kernel packages via configuration management and flag hosts running pre-fix builds
- Audit local user activity that invokes sysfs bind/unbind on SPI devices
How to Mitigate CVE-2026-64221
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced by commits 178b9b5, 1cd9270, 3bbbe7a, 9c6f306, d6f422b, d7a076f, ea6ec33, and f2dc841
- Update to a distribution kernel that includes the spi: ti-qspi: fix use-after-free after DMA setup failure fix
- Restrict local shell access on affected embedded and edge devices exposing the TI QSPI controller
Patch Information
The fix ensures the DMA channel pointer is cleared when buffer allocation fails, so subsequent code does not dereference or free the already-released channel. Patch commits are published on the upstream stable tree, including Kernel Update Commit 178b9b5, Kernel Update Commit 1cd9270, Kernel Update Commit 3bbbe7a, Kernel Update Commit 9c6f306, Kernel Update Commit d6f422b, Kernel Update Commit d7a076f, Kernel Update Commit ea6ec33, and Kernel Update Commit f2dc841.
Workarounds
- Blacklist the spi-ti-qspi module on systems that do not require the QSPI controller until the patched kernel is deployed
- Remove write permissions to /sys/bus/platform/drivers/ti-qspi/bind and unbind for non-root users
- Limit local access to trusted administrators on hardware that exposes the TI QSPI SPI controller
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
