Listen to this Post
Intro
The Linux kernel’s `spi-cadence-quadspi` driver contains a race condition that leads to unclocked register access during driver unbind. The driver uses runtime power management (PM) to gate clocks when the SPI controller is idle. When the driver is unbound (e.g., module removal, device hot‑unplug, system shutdown), the `cqspi_remove()` function must ensure the controller is powered on and clocked before touching its registers.
The vulnerable code path calls `cqspi_controller_enable(cqspi, 0)` and `clk_disable(cqspi->clk)` without first waking the device. If the controller is in a runtime‑suspended state, those register writes occur while the hardware clock is inactive. This violates the hardware protocol and can corrupt configuration registers, leave the SPI bus in an undefined state, or cause system instability.
The issue was introduced when runtime PM support was added (commit 0578a6dbfe75). The fix moves the disable sequence inside a `pm_runtime_get_sync()` block, guaranteeing the device is active before register access. The vulnerability is present in Linux kernel versions 6.7 through 7.0.8 and 7.1-rc1.
DailyCVE Form:
Platform: Linux Kernel
Version: 6.7‑7.0.8
Vulnerability: Unclocked register access
Severity: 5.5 (Medium)
Date: 2026‑05‑28
Prediction: 2026‑05‑28
What Undercode Say:
Analytics – The flaw was flagged during a code review of a controller deregistration fix. No public exploit exists, but local attackers can trigger the condition by causing driver unbind (e.g., modprobe -r spi-cadence-quadspi).
Check current kernel version uname -r List loaded SPI drivers lsmod | grep spi_cadence_quadspi Trigger the vulnerable unbind (if driver is bound) echo -n "spi-cadence-quadspi" > /sys/bus/platform/drivers/spi-cadence-quadspi/unbind Apply the patch (example for kernel 6.12.y) git cherry-pick 233db2cb14db8b1935dda52a6affd97276462b82
Vulnerable code (before fix)
static void cqspi_remove(struct platform_device pdev) {
cqspi_wait_idle(cqspi);
spi_unregister_controller(cqspi->host);
cqspi_controller_enable(cqspi, 0); // ← unclocked access
if (cqspi->rx_chan)
dma_release_channel(cqspi->rx_chan);
if (pm_runtime_get_sync(&pdev->dev) >= 0)
clk_disable(cqspi->clk);
}
Fixed code
static void cqspi_remove(struct platform_device pdev) {
cqspi_wait_idle(cqspi);
spi_unregister_controller(cqspi->host);
if (pm_runtime_get_sync(&pdev->dev) >= 0) {
cqspi_controller_enable(cqspi, 0); // ← safe, clock is active
clk_disable(cqspi->clk);
}
if (cqspi->rx_chan)
dma_release_channel(cqspi->rx_chan);
}
How Exploit:
An attacker with local access can trigger driver unbind by removing the kernel module (rmmod spi_cadence_quadspi), writing to the sysfs unbind interface, or causing a hot‑unplug event. The unclocked register write may corrupt SPI controller state, leading to denial of service (kernel panic, hang) or, in rare cases, privilege escalation if the corrupted state can be redirected. No remote exploit is known.
Protection:
- Upgrade to Linux kernel 7.0.9 or 7.1-rc2 or later.
- Backport the patch (commit `233db2cb14db` or
d67a5311818b) to older kernels. - Disable runtime PM for the cadence‑quadspi driver as a temporary workaround (add `pm_runtime_forbid(&pdev->dev)` in driver init).
- Restrict local access to trusted users only.
Impact:
Unclocked register access can cause hardware misconfiguration, lost SPI transactions, system crashes, or data corruption on attached flash devices. The issue is triggered during driver unbind, which is a common operation in module reloading, device removal, and system shutdown. While primarily a stability issue, it can be chained with other vulnerabilities for more severe consequences.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
