CVE-2026-23207

A race condition was found in the Tegra210 Quad SPI driver's IRQ handler. The curr_xfer pointer is checked for NULL without holding the spinlock, but can be set to NULL by the timeout path between the check and subsequent use, leading to a NULL pointer dereference when accessing t->len.

This vulnerability affects NVIDIA Tegra210-based systems using the Quad SPI controller. The race requires precise timing between the ISR thread and timeout handling, making it difficult to trigger but causing a kernel crash when it occurs.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.