CVE-2026-72134

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

spi: imx: reconfigure for PIO when DMA cannot be started

When spi_imx_can_dma() selects DMA, the ECSPI is configured for DMA:

spi_imx_setupxfer() sets CTRL.SMC and clears dynamic_burst, and

spi_imx_dma_transfer() programs the dynamic-burst BURST_LENGTH and the

SDMA watermarks.

If the DMA descriptor cannot be prepared (dmaengine_prep_slave_single()

returns NULL), the transfer is failed with SPI_TRANS_FAIL_NO_START and

falls back to PIO. The dynamic-burst DMA path uses its own bounce

buffers instead of the SPI core's mapping, so xfer->{tx,rx}_sg_mapped

are not set and the core's DMA->PIO retry is skipped; the driver falls

back to PIO internally. But none of the DMA-mode configuration is

undone, so the PIO transfer runs with CTRL.SMC set, the wrong burst

length and dynamic_burst cleared, and the transferred data is corrupted.

This is easily hit on i.MX8MP boards that describe ECSPI DMA in the

device tree but run SDMA

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References