CVE-2026-80752

The psxpad-spi driver in the Linux kernel (used to support Sony PlayStation 1/2 gamepads connected over SPI) never stores its controller state as SPI driver data during probe, but the suspend callback psxpad_spi_suspend() retrieves that data with spi_get_drvdata() and dereferences it. As a result, suspending a system with the driver in use causes a NULL pointer dereference in kernel mode. An attacker with local access who can trigger a suspend gains denial of service in the form of a kernel crash; the CVSS v3.1 vector (AV:L/AC:L/PR:N/UI:N) rates the issue 8.4 High. Affected are Linux systems where the psxpad-spi driver is built and bound to a device — typically hobbyist and embedded Linux deployments — while mainstream desktops and servers without this driver are unaffected. There is no known public proof of concept, it is not on the CISA KEV list, and EPSS puts 30-day exploitation probability at about 0.2%.

What to do: Update affected systems to a kernel that includes the 'psxpad-spi - set driver data before use' patch; no fixed version number was provided in the data, so check your vendor's kernel advisories. As an interim mitigation, avoid suspending systems while a psxpad-spi device is attached. Check exposure by confirming whether the psxpad-spi module is loaded (e.g., 'lsmod | grep psxpad'); systems without this driver are not affected.