Skip to main content

Linux Kernel EUVDEUVD-2026-45855

| CVE-2026-64170 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-07-19 Linux GHSA-m682-4gwr-mr4j
Denial Of Service Linux Null Pointer Dereference Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local vector confirmed by driver-level access requirement; PR:L because a low-privilege user can trigger the unbind or probe error path; no confidentiality or integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 13, 2026 - 16:14 vuln.today
CVSS changed
Aug 13, 2026 - 15:37 NVD
5.5 (MEDIUM)
Patch available
Jul 19, 2026 - 17:03 EUVD
CVE Published
Jul 19, 2026 - 15:40 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 15:40 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

spi: qup: fix error pointer deref after DMA setup failure

The driver falls back to PIO mode if DMA setup fails during probe.

Make sure to the clear the DMA channel pointers on setup failure to avoid dereferencing an error pointer (or attempting to release a channel a second time) on later probe errors or driver unbind.

This issue was flagged by Sashiko when reviewing a devres allocation conversion patch.

AnalysisAI

NULL pointer dereference in the Linux kernel's SPI QUP (Qualcomm Universal Peripheral) driver causes a local denial-of-service condition affecting Qualcomm SoC-based Linux systems. When DMA setup fails during driver probe, the fallback to PIO mode leaves DMA channel pointers in a stale error state rather than clearing them to NULL; a subsequent probe failure or driver unbind then dereferences those error pointers, triggering a kernel panic. Patches are available across all active stable branches (5.10.259, 5.15.210, 6.1.176, 6.6.142, 6.12.92, 6.18.34, 7.0.11, 7.1); no public exploit has been identified and EPSS is at the 6th percentile, indicating negligible exploitation probability at this time.

Technical ContextAI

The spi-qup driver manages Qualcomm's Universal Peripheral (QUP) SPI controller, found in Qualcomm SoC-based platforms including embedded, mobile, and IoT Linux devices. During device probe, the driver attempts DMA channel allocation; on failure, it is designed to fall back to programmed I/O (PIO) mode. The defect - classified as CWE-476 (NULL Pointer Dereference) - is that the driver fails to zero out the DMA channel pointer variables when DMA setup fails, leaving them holding error pointer values rather than NULL. When the driver later encounters a secondary probe error or undergoes unbind, it unconditionally uses those pointers - either attempting to release a channel that was never successfully acquired or branching through an error pointer - causing a kernel oops or panic. The issue was surfaced by a code reviewer (Sashiko) during inspection of a devres allocation conversion patch, confirming it as a latent pre-existing defect rather than a regression from the conversion itself. The CPE identifier is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* with the vulnerability introduced at commit 612762e82ae6058d69b4ce734598491bf030afe7.

RemediationAI

The primary remediation is to upgrade to a patched kernel version appropriate for the stable branch in use: 5.10.259, 5.15.210, 6.1.176, 6.6.142, 6.12.92, 6.18.34, 7.0.11, or 7.1. Upstream fixes are accessible via kernel.org stable commits including https://git.kernel.org/stable/c/0bb3bd442f0bdad3932739a61dd6c580c9c1955e (5.15 branch), https://git.kernel.org/stable/c/d577c55d189e7ae150973058d13e299b6855633f, and related commits listed in the references. Ubuntu has packaged the fix in USN-8593-1 (https://ubuntu.com/security/notices/USN-8593-1). For systems where kernel patching cannot be performed immediately on Qualcomm SoC hardware, a compensating control is to prevent loading of the spi-qup module by adding 'blacklist spi_qup' to /etc/modprobe.d/blacklist.conf and rebuilding the initramfs - note this disables the SPI QUP controller entirely, which will break any peripherals dependent on that bus (sensors, NOR flash, etc.) and may render the device unusable if critical hardware relies on it. Verify peripheral dependencies before applying this workaround.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

EUVD-2026-45855 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy