CVE-2026-23207

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

spi: tegra210-quad: Protect curr_xfer check in IRQ handler

Now that all other accesses to curr_xfer are done under the lock,

protect the curr_xfer NULL check in tegra_qspi_isr_thread() with the

spinlock. Without this protection, the following race can occur:

CPU0 (ISR thread) CPU1 (timeout path)

---------------- -------------------

if (!tqspi->curr_xfer)

// sees non-NULL

spin_lock()

tqspi->curr_xfer = NULL

spin_unlock()

handle_*_xfer()

spin_lock()

t = tqspi->curr_xfer // NULL!

... t->len ... // NULL dereference!

With this patch, all curr_xfer accesses are now properly synchronized.

Although all accesses to curr_xfer are done under the lock, in

tegra_qspi_isr_thread() it checks for NULL, releases the lock and

reacquires it later in handle_cpu_based_xfer()/hand

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References