CVE-2026-64170

A flaw was found in the Linux kernel's Serial Peripheral Interface (SPI) Qualcomm Universal Peripheral (QUP) driver. When the Direct Memory Access (DMA) setup fails during the driver's initialization, the driver attempts to fall back to Programmed Input/Output (PIO) mode. However, it fails to properly clear the DMA channel pointers, which could lead to dereferencing an invalid memory address. This could result in system instability or a denial of service, making the system unresponsive to legitimate requests.

This vulnerability is rated as Moderate severity because exploitation requires local access, specific Qualcomm hardware, and an initial DMA initialization failure during driver probe to trigger a denial of service (system crash). Systems running on architectures other than Qualcomm-based platforms are not exposed, as the affected driver binds only to specific Qualcomm Universal Peripheral hardware controllers. Furthermore, the issue only manifests during driver unbinding or subsequent probe failures following an error, limiting the blast radius.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.