CVE-2026-90012

CVE-2026-90012 is an error-handling flaw in the Linux kernel's SPI (Serial Peripheral Interface) subsystem: when RX DMA mapping fails after TX mapping has succeeded, or TX mapping fails on a later transfer, __spi_map_msg() leaves stale mapping flags and stale/NULL cur_tx_dma_dev/cur_rx_dma_dev pointers, because those device pointers are only published after all transfers are mapped. The follow-up spi_unmap_msg() can then unmap the same TX mapping twice or call dma_unmap_sg_attrs() with a NULL or stale device — and since that function dereferences the device before checking the SG entry count, a NULL device triggers a kernel oops (crash). An attacker who can cause DMA mapping failures on an SPI controller with DMA gains at minimum denial of service, and the incorrect release of DMA mappings carries potential memory-safety implications consistent with the reported critical CVSS (9.8), although the network vector depends on driver-specific conditions. Affected are any systems running Linux kernels with SPI controllers that use DMA, a configuration typical of embedded and ARM-based devices. No public proof-of-concept exists, the flaw is not in CISA KEV, and no exploitation is currently known.

What to do: Patch by pulling the upstream commit 'spi: Fix DMA mapping ownership on partial map failure' into your kernel or take the corresponding update from your kernel/board vendor's stable or LTS stream once published (no specific fixed version numbers are available in the source data), prioritizing ARM/embedded products whose kernels enable SPI controllers with DMA. No workaround is documented; if you cannot patch immediately, avoid workloads that stress SPI DMA under memory pressure and investigate any kernel oopses surfacing in dma_unmap_sg_attrs() during SPI transfers. Since no exploitation is known, systems not using SPI can patch at normal cadence.