CVE-2026-64303: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64303 Overview

CVE-2026-64303 affects the Linux kernel's Freescale Low-Power SPI (fsl-lpspi) driver. The flaw resides in the DMA setup error path for SPI transfers. When dmaengine_prep_slave_sg() fails for the TX channel, the driver terminates the TX DMA channel but leaves the RX channel active. The RX channel is submitted and issued before the TX descriptor is prepared, so returning -EINVAL triggers the SPI core to unmap DMA buffers while the RX engine continues writing to them.

This race between DMA writes and buffer unmapping produces memory corruption or use-after-free conditions in kernel memory.

Critical Impact
The active RX DMA channel writes to buffers already unmapped by the SPI core, causing kernel memory corruption or use-after-free on affected systems.

Affected Products

Linux kernel builds that include the spi-fsl-lpspi driver
NXP i.MX platforms using the Low-Power SPI controller
Stable kernel branches prior to the fix commits listed in the upstream advisory

Discovery Timeline

2026-07-25 - CVE-2026-64303 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64303

Vulnerability Analysis

The fsl-lpspi driver uses two DMA channels to move data during SPI transfers. The RX channel is prepared, submitted, and issued first so that inbound data can be captured. The driver then prepares the TX descriptor. If dmaengine_prep_slave_sg() fails on the TX side, the original error path calls only dmaengine_terminate_all() on the TX channel and returns -EINVAL.

Control returns to the SPI core, which unmaps the DMA-mapped buffers under the assumption that the transfer is aborted cleanly. The RX DMA engine, however, is still active and continues writing hardware data into memory that the kernel has already released back for reuse. The result is silent kernel memory corruption or a classic use-after-free window on the freed buffers.

The upstream patch terminates the RX channel before returning from the TX prepare failure path, restoring the invariant that no in-flight DMA engine outlives the buffers it targets.

Root Cause

The root cause is an incomplete error-handling path in the fsl-lpspi DMA setup logic. The driver did not enforce symmetric teardown of the RX and TX channels when TX descriptor preparation failed, violating the DMA API contract that all engines targeting a mapping must be stopped before that mapping is released.

Attack Vector

Exploitation requires triggering dmaengine_prep_slave_sg() failure during an SPI transaction on an affected controller. The scored network attack vector reflects the NVD assessment, but practical triggering depends on the ability to influence SPI transfer parameters or induce DMA allocation pressure on the target platform. Successful triggering leads to kernel memory corruption suitable for privilege escalation or denial of service on the affected host.

No verified public exploit is available. See the upstream commits, including Kernel Commit 01980b5 and Kernel Commit e65505d9, for the exact code path.

Detection Methods for CVE-2026-64303

Indicators of Compromise

Unexpected kernel oops or panic messages referencing spi-fsl-lpspi, dma_unmap_sg, or slab corruption during SPI activity
KASAN reports of use-after-free on DMA-mapped buffers originating from the SPI subsystem
Sporadic SPI transfer failures returning -EINVAL followed by kernel memory faults on i.MX platforms

Detection Strategies

Enable CONFIG_KASAN and CONFIG_DEBUG_DMA_API on test kernels to catch the race between RX DMA writes and buffer unmapping
Audit kernel package inventories on NXP i.MX devices for kernel versions predating the fix commits listed in the NVD advisory
Correlate SPI transfer error rates with kernel log entries for slab or DMA warnings

Monitoring Recommendations

Ship kernel logs from Linux endpoints to a central log store and alert on spi-fsl-lpspi error patterns combined with memory subsystem warnings
Track kernel version and build metadata across fleets so patched and unpatched hosts are identifiable at a glance
Monitor for unexpected reboots or crash dumps on embedded and edge devices that use the affected SPI controller

How to Mitigate CVE-2026-64303

Immediate Actions Required

Update affected Linux kernels to a stable release that includes the fix commits referenced by the NVD advisory
Rebuild and redeploy custom kernels for i.MX platforms with the corrected fsl-lpspi driver
Inventory all devices running the spi-fsl-lpspi driver and prioritize patching for production endpoints

Patch Information

The fix terminates the RX DMA channel on the TX prepare failure path. Backports are available across stable branches through the following commits: 01980b5, 808033d8, 9d000bdd, ad370d1c, af39a269, cce20634, d5c10602, and e65505d9.

Workarounds

Disable the spi-fsl-lpspi driver on systems that do not require it by unloading the module or removing it from the kernel build
Where feasible, switch affected SPI transfers to PIO mode to avoid the DMA setup path until the kernel is patched
Restrict physical and administrative access to i.MX devices that cannot be updated immediately

bash

# Verify running kernel and driver status
uname -r
lsmod | grep spi_fsl_lpspi
# Temporarily unload the driver if not required
sudo modprobe -r spi_fsl_lpspi