EUVD-2026-70356
GHSA-8qwq-c5q8-xcxf
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local driver suspend bug requires hardware attachment and suspend trigger; NULL deref causes kernel crash (A:H only) with no confidentiality or integrity impact; low privilege sufficient to initiate suspend on desktop systems.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
Input: psxpad-spi - set driver data before use
psxpad_spi_suspend() retrieves the controller state with spi_get_drvdata(), but probe never stores it, so suspend dereferences a NULL pointer. Store it during probe.
AnalysisAI
NULL pointer dereference in the Linux kernel's psxpad-spi driver crashes the kernel when system suspend is triggered on hardware using SPI-connected PlayStation controllers. The probe() function in drivers/input/joystick/psxpad-spi.c omits the spi_set_drvdata() call that stores per-device state, so psxpad_spi_suspend() unconditionally dereferences a NULL pointer on suspend entry, causing a kernel panic. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two specific conditions must both be present: (1) the psxpad-spi kernel module must be loaded, which in practice requires SPI-connected PlayStation controller hardware to be physically attached (or the module manually forced), and (2) the system must enter suspend state (suspend-to-RAM or suspend-to-disk) while that driver is active. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS score of 8.4 with C:H/I:H/A:H is substantially overstated for what is a kernel DoS via NULL pointer dereference in a niche peripheral driver. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a patched kernel release: 7.2, 7.1.10, 6.18.46, 6.12.105, 6.6.153, 6.1.184, 5.15.217, or 5.10.266 depending on the branch in use. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your infrastructure inventory to determine if you operate any Linux systems with SPI-connected PlayStation controller hardware; most organizations will find none. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today