CVE-2026-23207

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

spi: tegra210-quad: Protect curr_xfer check in IRQ handler

Now that all other accesses to curr_xfer are done under the lock,

protect the curr_xfer NULL check in tegra_qspi_isr_thread() with the

spinlock. Without this protection, the following race can occur:

CPU0 (ISR thread) CPU1 (timeout path)

---------------- -------------------

if (!tqspi->curr_xfer)

// sees non-NULL

spin_lock()

tqspi->curr_xfer = NULL

spin_unlock()

handle_*_xfer()

spin_lock()

t = tqspi->curr_xfer // NULL!

... t->len ... // NULL dereference!

With this patch, all curr_xfer accesses are now properly synchronized.

Although all accesses to curr_xfer are done under the lock, in

tegra_qspi_isr_thread() it checks for NULL, releases the lock and

reacquires it later in handle_cpu_based_xfer()/hand

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References