CVE-2026-90012: Linux Kernel SPI Use-After-Free Vulnerability

CVE-2026-90012 Overview

CVE-2026-90012 is a Linux kernel vulnerability in the Serial Peripheral Interface (SPI) subsystem. The flaw resides in __spi_map_msg(), which mishandles Direct Memory Access (DMA) mapping ownership when a partial mapping failure occurs during message transfer setup. When RX mapping fails after TX mapping succeeds, the kernel unmaps TX but leaves tx_sg_mapped set. A subsequent spi_unmap_msg() call can unmap the TX buffer again or release earlier mappings using a NULL or stale device pointer. The resulting NULL pointer dereference can trigger a kernel oops and destabilize the affected system.

Critical Impact
A partial DMA mapping failure in the SPI subsystem can cause a NULL pointer dereference in dma_unmap_sg_attrs(), leading to a kernel oops and denial of service on affected Linux systems.

Affected Products

Linux kernel SPI subsystem (drivers/spi/spi.c)
Stable kernel branches receiving the referenced backport commits
Distributions shipping the vulnerable __spi_map_msg() implementation

Discovery Timeline

2026-09-16 - CVE-2026-90012 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90012

Vulnerability Analysis

The vulnerability lives in __spi_map_msg() within the Linux kernel SPI subsystem. During message setup, the function walks each transfer and creates DMA scatter-gather mappings for TX and RX buffers. The device handles used to create those mappings, cur_tx_dma_dev and cur_rx_dma_dev, are only assigned after every transfer has been mapped successfully.

When a partial failure occurs mid-loop, the cleanup path becomes inconsistent. If RX mapping fails after TX mapping succeeds on the same transfer, the function unmaps TX but leaves the tx_sg_mapped flag set. If TX mapping fails on a later transfer, mappings from earlier transfers remain live while their owning device pointers are still NULL or stale.

When spi_unmap_msg() later runs, it either double-unmaps the TX buffer or passes a NULL device to dma_unmap_sg_attrs(). Because dma_unmap_sg_attrs() dereferences the device before checking the scatter-gather entry count, an empty SG table does not prevent the fault. The result is a kernel oops originating from DMA unmap code paths.

Root Cause

The root cause is a violation of resource ownership invariants during error handling [CWE-476, Null Pointer Dereference]. Mapping flags and device pointers are updated at different points in the setup path, so a partial failure leaves the kernel with mapping flags set but no valid device pointer recording who created the mapping.

Attack Vector

Triggering the flaw requires inducing a DMA mapping failure inside __spi_map_msg() during SPI message submission. The upstream fix publishes both mapping devices before the mapping loop begins and routes every failure through __spi_unmap_msg(), which clears the mapping flags and releases each mapping once with the device that created it.

The vulnerability is described in prose only. See the upstream fixes for implementation details: Linux Kernel Commit 367cea2, Linux Kernel Commit 5def8b6, Linux Kernel Commit a38051f, and Linux Kernel Commit cc83542.

Detection Methods for CVE-2026-90012

Indicators of Compromise

Kernel oops messages referencing dma_unmap_sg_attrs() or spi_unmap_msg() in call traces
NULL pointer dereferences originating from the SPI subsystem (drivers/spi/spi.c)
Repeated soft lockups or crashes on systems performing high-volume SPI transfers under memory pressure

Detection Strategies

Compare the running kernel version against the fixed stable releases containing the referenced backport commits.
Review kernel logs (dmesg, journalctl -k) for oops signatures involving SPI DMA teardown paths.
Audit installed kernel packages across the fleet to identify hosts still running vulnerable builds.

Monitoring Recommendations

Forward kernel crash telemetry and kdump artifacts to a central log platform for correlation.
Alert on repeat kernel panics on the same host class, especially systems with SPI-connected peripherals such as sensors, flash chips, or industrial controllers.
Track patch compliance status for Linux endpoints and infrastructure hosts using an endpoint inventory source.

How to Mitigate CVE-2026-90012

Immediate Actions Required

Identify Linux systems running kernel versions predating the referenced stable commits, prioritizing hosts with active SPI workloads.
Apply the vendor-provided kernel updates from your distribution as soon as they are available.
Schedule reboots on patched systems to activate the fixed kernel image.

Patch Information

The fix publishes both DMA mapping devices before the mapping loop starts and unwinds all failures through __spi_unmap_msg(), ensuring mapping flags are cleared and each mapping is released once with the device that created it. Apply the upstream stable commits: 367cea2, 5def8b6, a38051f, and cc83542.

Workarounds

No official workaround exists; patching the kernel is the supported remediation.
Where patching is delayed, restrict physical and logical access to SPI-attached peripherals to reduce the ability to induce mapping pressure.
Monitor kernel logs for early signs of DMA teardown faults and quarantine affected hosts pending update.

bash

# Verify running kernel version and check for SPI-related oops entries
uname -r
journalctl -k --since "7 days ago" | grep -Ei "spi|dma_unmap_sg"