CVE-2026-23207 (GCVE-0-2026-23207)

Vulnerability from cvelistv5 – Published: 2026-02-14 16:27 – Updated: 2026-02-14 16:27
VLAI?
Title
spi: tegra210-quad: Protect curr_xfer check in IRQ handler
Summary
In the Linux kernel, the following vulnerability has been resolved: spi: tegra210-quad: Protect curr_xfer check in IRQ handler Now that all other accesses to curr_xfer are done under the lock, protect the curr_xfer NULL check in tegra_qspi_isr_thread() with the spinlock. Without this protection, the following race can occur: CPU0 (ISR thread) CPU1 (timeout path) ---------------- ------------------- if (!tqspi->curr_xfer) // sees non-NULL spin_lock() tqspi->curr_xfer = NULL spin_unlock() handle_*_xfer() spin_lock() t = tqspi->curr_xfer // NULL! ... t->len ... // NULL dereference! With this patch, all curr_xfer accesses are now properly synchronized. Although all accesses to curr_xfer are done under the lock, in tegra_qspi_isr_thread() it checks for NULL, releases the lock and reacquires it later in handle_cpu_based_xfer()/handle_dma_based_xfer(). There is a potential for an update in between, which could cause a NULL pointer dereference. To handle this, add a NULL check inside the handlers after acquiring the lock. This ensures that if the timeout path has already cleared curr_xfer, the handler will safely return without dereferencing the NULL pointer.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 01bbf25c767219b14c3235bfa85906b8d2cb8fbc , < 2ac3a105e51496147c0e44e49466eecfcc532d57 (git)
Affected: b4e002d8a7cee3b1d70efad0e222567f92a73000 , < edf9088b6e1d6d88982db7eb5e736a0e4fbcc09e (git)
Affected: 88db8bb7ed1bb474618acdf05ebd4f0758d244e2 (git)
Affected: 83309dd551cfd60a5a1a98d9cab19f435b44d46d (git)
Affected: c934e40246da2c5726d14e94719c514e30840df8 (git)
Affected: 551060efb156c50fe33799038ba8145418cfdeef (git)
Affected: bb0c58be84f907285af45657c1d4847b960a12bf (git)
Create a notification for this product.
    Linux Linux Affected: 6.18.2 , < 6.18.10 (semver)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/spi/spi-tegra210-quad.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2ac3a105e51496147c0e44e49466eecfcc532d57",
              "status": "affected",
              "version": "01bbf25c767219b14c3235bfa85906b8d2cb8fbc",
              "versionType": "git"
            },
            {
              "lessThan": "edf9088b6e1d6d88982db7eb5e736a0e4fbcc09e",
              "status": "affected",
              "version": "b4e002d8a7cee3b1d70efad0e222567f92a73000",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "88db8bb7ed1bb474618acdf05ebd4f0758d244e2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "83309dd551cfd60a5a1a98d9cab19f435b44d46d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c934e40246da2c5726d14e94719c514e30840df8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "551060efb156c50fe33799038ba8145418cfdeef",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "bb0c58be84f907285af45657c1d4847b960a12bf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/spi/spi-tegra210-quad.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.18.10",
              "status": "affected",
              "version": "6.18.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.10",
                  "versionStartIncluding": "6.18.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.198",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.160",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.6.120",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.12.63",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.17.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: tegra210-quad: Protect curr_xfer check in IRQ handler\n\nNow that all other accesses to curr_xfer are done under the lock,\nprotect the curr_xfer NULL check in tegra_qspi_isr_thread() with the\nspinlock. Without this protection, the following race can occur:\n\n  CPU0 (ISR thread)              CPU1 (timeout path)\n  ----------------               -------------------\n  if (!tqspi-\u003ecurr_xfer)\n    // sees non-NULL\n                                 spin_lock()\n                                 tqspi-\u003ecurr_xfer = NULL\n                                 spin_unlock()\n  handle_*_xfer()\n    spin_lock()\n    t = tqspi-\u003ecurr_xfer  // NULL!\n    ... t-\u003elen ...        // NULL dereference!\n\nWith this patch, all curr_xfer accesses are now properly synchronized.\n\nAlthough all accesses to curr_xfer are done under the lock, in\ntegra_qspi_isr_thread() it checks for NULL, releases the lock and\nreacquires it later in handle_cpu_based_xfer()/handle_dma_based_xfer().\nThere is a potential for an update in between, which could cause a NULL\npointer dereference.\n\nTo handle this, add a NULL check inside the handlers after acquiring\nthe lock. This ensures that if the timeout path has already cleared\ncurr_xfer, the handler will safely return without dereferencing the\nNULL pointer."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-14T16:27:29.762Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2ac3a105e51496147c0e44e49466eecfcc532d57"
        },
        {
          "url": "https://git.kernel.org/stable/c/edf9088b6e1d6d88982db7eb5e736a0e4fbcc09e"
        }
      ],
      "title": "spi: tegra210-quad: Protect curr_xfer check in IRQ handler",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23207",
    "datePublished": "2026-02-14T16:27:29.762Z",
    "dateReserved": "2026-01-13T15:37:45.986Z",
    "dateUpdated": "2026-02-14T16:27:29.762Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23207\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-02-14T17:15:58.610\",\"lastModified\":\"2026-02-18T17:52:22.253\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nspi: tegra210-quad: Protect curr_xfer check in IRQ handler\\n\\nNow that all other accesses to curr_xfer are done under the lock,\\nprotect the curr_xfer NULL check in tegra_qspi_isr_thread() with the\\nspinlock. Without this protection, the following race can occur:\\n\\n  CPU0 (ISR thread)              CPU1 (timeout path)\\n  ----------------               -------------------\\n  if (!tqspi-\u003ecurr_xfer)\\n    // sees non-NULL\\n                                 spin_lock()\\n                                 tqspi-\u003ecurr_xfer = NULL\\n                                 spin_unlock()\\n  handle_*_xfer()\\n    spin_lock()\\n    t = tqspi-\u003ecurr_xfer  // NULL!\\n    ... t-\u003elen ...        // NULL dereference!\\n\\nWith this patch, all curr_xfer accesses are now properly synchronized.\\n\\nAlthough all accesses to curr_xfer are done under the lock, in\\ntegra_qspi_isr_thread() it checks for NULL, releases the lock and\\nreacquires it later in handle_cpu_based_xfer()/handle_dma_based_xfer().\\nThere is a potential for an update in between, which could cause a NULL\\npointer dereference.\\n\\nTo handle this, add a NULL check inside the handlers after acquiring\\nthe lock. This ensures that if the timeout path has already cleared\\ncurr_xfer, the handler will safely return without dereferencing the\\nNULL pointer.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nspi: tegra210-quad: Proteger la comprobaci\u00f3n de curr_xfer en el manejador IRQ\\n\\nAhora que todos los dem\u00e1s accesos a curr_xfer se realizan bajo el bloqueo, proteger la comprobaci\u00f3n de NULL de curr_xfer en tegra_qspi_isr_thread() con el spinlock. Sin esta protecci\u00f3n, la siguiente condici\u00f3n de carrera puede ocurrir:\\n\\n  CPU0 (hilo ISR)              CPU1 (ruta de tiempo de espera)\\n  ----------------               -------------------\\n  if (!tqspi-\u0026gt;curr_xfer)\\n    // ve no-NULL\\n                                 spin_lock()\\n                                 tqspi-\u0026gt;curr_xfer = NULL\\n                                 spin_unlock()\\n  handle_*_xfer()\\n    spin_lock()\\n    t = tqspi-\u0026gt;curr_xfer  // \u00a1NULL!\\n    ... t-\u0026gt;len ...        // \u00a1Desreferencia de NULL!\\n\\nCon este parche, todos los accesos a curr_xfer est\u00e1n ahora correctamente sincronizados.\\n\\nAunque todos los accesos a curr_xfer se realizan bajo el bloqueo, en tegra_qspi_isr_thread() comprueba si es NULL, libera el bloqueo y lo vuelve a adquirir m\u00e1s tarde en handle_cpu_based_xfer()/handle_dma_based_xfer(). Existe la posibilidad de una actualizaci\u00f3n intermedia, lo que podr\u00eda causar una desreferencia de puntero NULL.\\n\\nPara manejar esto, a\u00f1adir una comprobaci\u00f3n de NULL dentro de los manejadores despu\u00e9s de adquirir el bloqueo. Esto asegura que si la ruta de tiempo de espera ya ha limpiado curr_xfer, el manejador regresar\u00e1 de forma segura sin desreferenciar el puntero NULL.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2ac3a105e51496147c0e44e49466eecfcc532d57\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/edf9088b6e1d6d88982db7eb5e736a0e4fbcc09e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.