Linux Kernel CVE-2026-64169

The ep93xx SPI driver (drivers/spi/spi-ep93xx.c) manages the Serial Peripheral Interface controller on Cirrus Logic EP93xx ARM SoCs. During probe, the driver attempts to allocate DMA channels; on failure, it falls back to PIO (Programmed I/O) mode, which is the intended behavior. The defect is that after DMA allocation failure, the driver retains the error pointer values (non-NULL invalid kernel addresses returned by failed DMA setup calls) in the DMA channel pointer fields rather than setting them to NULL. Subsequent code paths - triggered by a later probe error or by driver unbind via sysfs - evaluate these pointers without expecting them to carry error-pointer values, causing an invalid kernel memory dereference. CWE-476 (NULL Pointer Dereference) is the assigned root-cause class, though technically the dereference is of an ERR_PTR value rather than NULL; both represent invalid pointer dereference in kernel context and produce the same crash outcome. The fix, flagged during a devres allocation conversion review by Sashiko, is straightforward: zero the DMA channel pointers on setup failure. CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.