CVE-2026-89594: Linux Kernel OMAP SSI Buffer Overflow Flaw

CVE-2026-89594 Overview

CVE-2026-89594 is a Linux kernel vulnerability in the hsi: omap_ssi_core driver. The OMAP Synchronous Serial Interface (SSI) driver allocates a synthetic High-Speed Synchronous Serial Interface (HSI) controller device via hsi_alloc_controller(). This device does not traverse the standard Open Firmware (OF) or platform device initialization path, so the embedded struct device lacks an initialized Direct Memory Access (DMA) mask. Recent DMA API hardening requires a valid dma_mask for dma_map_sg() and related helpers. Without it, the driver can crash or emit warnings during DMA mapping operations, producing local denial-of-service and integrity impact on affected kernels.

Critical Impact
A local, low-privileged actor interacting with the OMAP SSI subsystem can trigger kernel crashes or memory-mapping faults, affecting confidentiality, integrity, and availability on the host.

Affected Products

Linux kernel builds including the hsi/omap_ssi_core driver prior to the fix commits listed in the kernel.org stable tree
OMAP-based platforms (e.g., Nokia N900 class hardware) that instantiate the OMAP SSI controller
Distribution kernels shipping the vulnerable omap_ssi_core module without the DMA mask initialization patch

Discovery Timeline

2026-09-11 - CVE-2026-89594 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89594

Vulnerability Analysis

The defect resides in the OMAP SSI host controller support inside the Linux kernel HSI framework. Standard platform devices receive DMA configuration during probe through the OF or platform bus infrastructure. The synthetic HSI controller device is allocated directly by hsi_alloc_controller(), bypassing that initialization. Consequently, dev->dma_mask remains NULL and dev->coherent_dma_mask is unset when the driver invokes scatter/gather DMA mapping helpers.

Recent hardening in the DMA API enforces validation of dma_mask before permitting mapping. When the OMAP SSI driver calls dma_map_sg() or equivalent helpers against the uninitialized device, the kernel emits warnings and may dereference invalid state. This produces kernel oops conditions on systems that exercise the SSI transport path. The impact is local, but the severity reflects high confidentiality, integrity, and availability consequences within the kernel address space.

Root Cause

The root cause is a missing initialization step in device setup, a configuration and design flaw. The hsi_alloc_controller() allocation path does not attach a valid DMA mask to the embedded struct device. The fix explicitly assigns dev->dma_mask = &dev->coherent_dma_mask and calls dma_set_mask_and_coherent() with a 32-bit mask that matches the underlying hardware addressing capability.

Attack Vector

Exploitation requires local access with low privileges on a system that loads the vulnerable omap_ssi_core module and exercises the SSI transport. No user interaction is needed. Triggering DMA mapping operations on the uninitialized controller device leads to warnings or kernel crashes. Refer to the Linux Kernel commit fixing the DMA mask setup for the corrective change.

No verified public proof-of-concept code is available for this issue. The vulnerability manifests through normal DMA API usage against an uninitialized device structure. See the stable kernel commit references for technical details.

Detection Methods for CVE-2026-89594

Indicators of Compromise

Kernel warnings or WARN_ON splats originating from dma_map_sg() or related DMA helpers referencing the omap_ssi controller device
Kernel oops or panic traces with the omap_ssi_core module in the call stack during device probe or data transfer
Repeated module load failures or SSI subsystem instability recorded in dmesg and journalctl output

Detection Strategies

Audit running kernel versions across OMAP-based fleets and compare against the fixed commit hashes published in the kernel.org stable tree
Correlate dmesg output for DMA mapping warnings that reference HSI or SSI controller devices
Use configuration management tooling to identify hosts with the omap_ssi_core module loaded but not patched

Monitoring Recommendations

Forward kernel logs to a centralized log platform and alert on repeated dma_map_sg warnings or kernel oops entries referencing HSI drivers
Track kernel package versions in asset inventory and flag hosts running vulnerable builds
Monitor for unexpected module load or reload events involving omap_ssi_core in production

How to Mitigate CVE-2026-89594

Immediate Actions Required

Apply the upstream kernel patches referenced in the kernel.org stable tree that add DMA mask initialization to the OMAP SSI controller device
Update to a distribution kernel that incorporates the fix and reboot affected OMAP-based systems
Restrict local access to systems exposing the OMAP SSI subsystem while patches are being staged

Patch Information

Fixes are available across multiple stable branches. Review the commits at the primary Linux kernel patch and additional backports including commit 6a5426f5, commit 9963a65b, commit 9ecef057, commit a4beb841, commit e81250ec, commit e8d47e30, and commit fbffbfda.

Workarounds

Unload the omap_ssi_core module on systems that do not require HSI functionality using modprobe -r omap_ssi_core
Blacklist the omap_ssi_core and related omap_ssi_port modules where the SSI transport is unused
Limit local shell access on OMAP-based devices to trusted administrators until the patched kernel is deployed

bash

# Blacklist the vulnerable module until the patched kernel is installed
echo "blacklist omap_ssi_core" | sudo tee /etc/modprobe.d/blacklist-omap-ssi.conf
sudo depmod -a
sudo update-initramfs -u