CVE-2026-93814

A flaw was found in the Linux kernel's Serial Peripheral Interface (SPI) subsystem. When a system suspend is initiated while an SPI controller operating in target mode has an active data transfer, the ongoing transfer is not cleanly aborted. This issue allows a local user to cause a Denial of Service (DoS), as the hardware is left in an inconsistent state that can hang the system or prevent it from resuming cleanly.

A low impact denial of service flaw was found in the Linux kernel's Serial Peripheral Interface (SPI) subsystem. When system suspend is initiated while an SPI controller operating in target mode has an active data transfer in progress, the suspend path does not abort the ongoing transfer, leaving the hardware in an inconsistent state that can cause the system to hang or fail to resume cleanly. Exploitation requires local access and depends on an uncommon hardware configuration (an SPI controller operating in target mode) together with precise timing so that a transfer is actively in progress during the suspend transition; the impact is limited to availability, with no effect on confidentiality or integrity. The affected Red Hat products are Red Hat Enterprise Linux 8, 9, and 10 (kernel and kernel-rt), Red Hat In-Vehicle OS 2, and OpenShift Container Platform 4 and 5 via the RHEL CoreOS kernel. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those streams. Fixes for the affected streams are currently deferred given the low severity and the narrow hardware and timing conditions required to trigger the flaw; the residual risk is a local denial of service (system hang or failure to resume after suspend) on systems using an SPI controller in target mode. Although the CVSS:3.1 base score is 5.5 (Moderate), Red Hat assessed the impact as low because of the restrictive prerequisites needed to trigger the issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.