CVE-2026-89594

The Linux kernel's OMAP SSI (High-speed Synchronous Serial Interface) controller driver allocates a synthetic HSI controller device via hsi_alloc_controller(), which bypasses normal OF/platform device initialization and leaves the embedded struct device without a DMA mask. After recent DMA API hardening changes, DMA mapping helpers such as dma_map_sg() require a valid dma_mask, so the driver may crash or trigger kernel warnings whenever it attempts DMA operations. The flaw is rated CVSS 3.1 7.8 (high) with a local attack vector and low privileges required, but its practical effect is primarily faulting the kernel or the SSI/modem data path (denial of service) on affected hardware rather than direct data theft. Affected systems are limited to devices on TI OMAP SoCs that enable the omap_ssi HSI driver, typically legacy modem-equipped OMAP-based phones and embedded boards. No public proof-of-concept exists, the flaw is not in the CISA KEV, and no exploitation in the wild is known.

What to do: Update to a kernel release containing the omap_ssi_core fix, which explicitly initializes the SSI controller device with a 32-bit DMA mask, and ensure distributions backport it wherever the recent DMA API hardening was applied. On OMAP hardware with an SSI-attached modem, check dmesg for DMA-mapping warnings or kernel crashes originating in the HSI path. If a fixed kernel is not yet available, disabling the omap_ssi driver or the modem interface avoids triggering the fault.