CVE-2026-46148

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

spi: microchip-core-qspi: control built-in cs manually

The coreQSPI IP supports only a single chip select, which is

automagically operated by the hardware - set low when the transmit

buffer first gets written to and set high when the number of bytes

written to the TOTALBYTES field of the FRAMES register have been sent on

the bus. Additional devices must use GPIOs for their chip selects.

It was reported to me that if there are two devices attached to this

QSPI controller that the in-built chip select is set low while linux

tries to access the device attached to the GPIO.

This went undetected as the boards that connected multiple devices to

the SPI controller all exclusively used GPIOs for chip selects, not

relying on the built-in chip select at all. It turns out that this was

because the built-in chip select, when controlled automagically, is set

low when active and high when inactive, thereby ruling out its use for

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References