CVE-2026-64221

A flaw was found in the spi: ti-qspi component of the Linux kernel. This use-after-free vulnerability occurs when the driver attempts to fall back to PIO mode after a Direct Memory Access (DMA) setup failure during probe. If the DMA channel pointer is not properly cleared after a buffer allocation failure, it can lead to the use of a freed memory region. This could allow a local attacker to cause a denial of service or potentially escalate privileges.

An IMPORTANT severity use-after-free flaw was found in the Linux kernel spi: ti-qspi (Texas Instruments Quad SPI) driver. During driver probe, if DMA setup fails the driver falls back to PIO mode; however, if the subsequent buffer allocation also fails, the DMA channel pointer is not cleared. As a result, a pointer to an already-released DMA channel can be passed to the DMA engine, or the channel can be freed a second time on late probe errors or driver unbind, resulting in a use-after-free. A local attacker with limited privileges who can trigger this error path could use this flaw to crash the kernel (denial of service) or potentially escalate privileges. Red Hat rates this flaw CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), lower than the upstream CVEORG score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), because successful exploitation requires a specific and complex sequence of DMA setup and buffer allocation failures during probe. All Red Hat Enterprise Linux (kernel and kernel-rt) and Red Hat In-Vehicle OS kernel streams currently listed in this flaw are marked NOT AFFECTED because the vulnerable code is not present in the shipped kernel versions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.