CVE-2026-90012

A flaw was found in the Linux kernel's Serial Peripheral Interface (SPI) subsystem. When handling Direct Memory Access (DMA) mappings, an issue arises if a receive (RX) mapping fails after a transmit (TX) mapping succeeds, or if a TX mapping fails during a subsequent transfer. This can lead to incorrect unmapping operations, where the spi_unmap_msg() function attempts to use a null or stale device pointer. Such an action can trigger a kernel 'oops,' resulting in a system crash and a denial of service.

A DMA mapping ownership bug in the SPI core can occur when __spi_map_msg sees a partial mapping failure. If RX mapping fails after TX mapping succeeds, tx_sg_mapped can remain set even though TX was already unmapped. If TX mapping fails on a later transfer, mappings from earlier transfers can remain active and later spi_unmap_msg may use a NULL or stale DMA device or release the same mapping twice. This can trigger a kernel oops through a NULL device dereference and may create limited DMA resource ownership risk. For the CVSS the PR:L is used because reliable triggering normally requires local ability to submit SPI transfers or control a local service or device node that can reach the SPI controller. The issue is not network reachable. Impact is at least local denial of service via kernel crash, with conservative limited confidentiality or integrity impact in the paranoid score due to stale device and double unmap behavior.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.