CVE-2026-23207
- Source
- https://cve.org/CVERecord?id=CVE-2026-23207
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23207.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-23207
- Downstream
AZL (1)
BELL (1)
CGA (25)
- CGA-2m74-f78w-h5rg
- CGA-2qx4-q94j-q4ff
- CGA-437w-qf4x-327x
- CGA-52mw-v8h5-3f66
- CGA-64jp-9gx8-27xf
- CGA-6mqq-4mcx-5g97
- CGA-755c-fcxw-8rx5
- CGA-95fp-94gq-83w7
- CGA-98vx-mcr7-p4hf
- CGA-9rwh-2cr4-c848
- CGA-c9qg-3x59-p5qm
- CGA-ccp7-xrc3-277w
- CGA-fgf3-x653-cmww
- CGA-fgm4-8qj2-9pp6
- CGA-g4wr-7j9x-c477
- CGA-gf7f-g363-9gxj
- CGA-h2h8-xr22-2prh
- CGA-h8ww-4x35-qcvq
- CGA-m295-rjw6-c3fx
- CGA-mh9g-hxpm-7jgh
- CGA-rp24-w892-gjvh
- CGA-vc3j-fhxr-v3v4
- CGA-vpv3-x7wp-rp8j
- CGA-vwh9-m542-q9x8
- CGA-xw7g-3jgq-hvvg
DEBIAN (1)
ECHO (1)
openSUSE (1)
ROOT (4)
SUSE (14)
- Related
- Published
- 2026-02-14T16:27:29Z
- Modified
- 2026-10-22T02:49:07Z
- Summary
- spi: tegra210-quad: Protect curr_xfer check in IRQ handler
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
spi: tegra210-quad: Protect curr_xfer check in IRQ handler
Now that all other accesses to curr_xfer are done under the lock, protect the curr_xfer NULL check in tegra_qspi_isr_thread() with the spinlock. Without this protection, the following race can occur:
CPU0 (ISR thread) CPU1 (timeout path)
if (!tqspi->curr_xfer) // sees non-NULL spin_lock() tqspi->curr_xfer = NULL spin_unlock() handle_*_xfer() spin_lock() t = tqspi->curr_xfer // NULL! ... t->len ... // NULL dereference!
With this patch, all curr_xfer accesses are now properly synchronized.
Although all accesses to curr_xfer are done under the lock, in tegra_qspi_isr_thread() it checks for NULL, releases the lock and reacquires it later in handle_cpu_based_xfer()/handle_dma_based_xfer(). There is a potential for an update in between, which could cause a NULL pointer dereference.
To handle this, add a NULL check inside the handlers after acquiring the lock. This ensures that if the timeout path has already cleared curr_xfer, the handler will safely return without dereferencing the NULL pointer.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23207.json" }- References
-
- https://git.kernel.org/stable/c/2ac3a105e51496147c0e44e49466eecfcc532d57
- https://git.kernel.org/stable/c/513587caec66b67243027f26867ad3512f06744f
- https://git.kernel.org/stable/c/84e926c1c272a35ddb9b86842d32fa833a60dfc7
- https://git.kernel.org/stable/c/edf9088b6e1d6d88982db7eb5e736a0e4fbcc09e
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23207.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-23207
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedc934e40246da2c5726d14e94719c514e30840df8Fixed513587caec66b67243027f26867ad3512f06744f
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced551060efb156c50fe33799038ba8145418cfdeefFixed84e926c1c272a35ddb9b86842d32fa833a60dfc7
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced01bbf25c767219b14c3235bfa85906b8d2cb8fbcFixed2ac3a105e51496147c0e44e49466eecfcc532d57
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedb4e002d8a7cee3b1d70efad0e222567f92a73000Fixededf9088b6e1d6d88982db7eb5e736a0e4fbcc09e
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced5.15.198Fixed5.16
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.1.160Fixed6.2
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.17.13Fixed6.18
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced88db8bb7ed1bb474618acdf05ebd4f0758d244e2
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced83309dd551cfd60a5a1a98d9cab19f435b44d46d
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedbb0c58be84f907285af45657c1d4847b960a12bf