CVE-2026-43319

A flaw was found in the Linux kernel's spidev driver. A local user, by performing concurrent write and ioctl operations on the same spidev file descriptor from separate threads, could trigger a lock inversion. This issue can lead to a deadlock, resulting in a Denial of Service (DoS) for the affected system.

This vulnerability is rated as Moderate severity because exploitation requires local access with permissions to open a character device node for the SPI userspace interface, and the resulting impact is confined to a denial of service. The flaw occurs under multithreaded contention when simultaneous I/O operations and control commands target the same device descriptor, creating a circular mutex deadlock. Typical enterprise server deployments do not expose SPI bus interfaces to unprivileged users, significantly reducing the likelihood of exploitation outside specialized or embedded environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.