CVE-2026-74415

A flaw was found in the Linux kernel's atcspi200 Serial Peripheral Interface (SPI) driver. When the driver unbinds, the Direct Memory Access (DMA) resource can be prematurely deallocated while the SPI controller is still active and initiating DMA transfers. This timing issue can lead to a use-after-free vulnerability, which may allow a local attacker to cause a denial of service or potentially execute arbitrary code.

Moderate impact has been assigned to this flaw because triggering the condition requires local administrative privileges to unbind the driver on systems configured with specific ATCSPI200 SPI hardware, limiting the overall attack surface and blast radius. The vulnerable driver logic is not present in supported Red Hat Enterprise Linux releases, as the flaw stems from changes introduced in upstream kernel version 7.0. Consequently, standard Red Hat Enterprise Linux deployments are not affected by this vulnerability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.