{"id":"CVE-2026-64221","summary":"spi: ti-qspi: fix use-after-free after DMA setup failure","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: ti-qspi: fix use-after-free after DMA setup failure\n\nThe driver falls back to PIO mode if DMA setup fails during probe.\n\nMake sure to clear the DMA channel pointer also if buffer allocation\nfails to avoid passing a pointer to the released channel to the DMA\nengine (or trying to free the channel a second time on late probe errors\nor driver unbind).\n\nThis issue was flagged by Sashiko when reviewing a devres allocation\nconversion patch.","modified":"2026-07-28T03:46:33.282059398Z","published":"2026-07-24T15:23:07.502Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64221.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/178b9b570c0f75fa7e691490520328b20d19138e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/1cd927002120678bd5d23c760246639caa53040e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/3bbbe7ae3fdada0df4157c1ffe989f92dfa8dcd6"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9c6f306a8140962c7284197db54b96fdb5f468d6"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d6f422b122922d1abee907d673bcc990e5f3672d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d7a076fb596c7b408ed6df74793a597990a6d860"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ea6ec3343e05f7937a53eb6d7617b3abdb4abc19"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f2dc841d7dc9063fe9b47ced869b1271e55052ae"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64221.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64221"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"c687c46e9e4527c4b4d82bc3cca58c1b08bcfb83"},{"fixed":"9c6f306a8140962c7284197db54b96fdb5f468d6"},{"fixed":"3bbbe7ae3fdada0df4157c1ffe989f92dfa8dcd6"},{"fixed":"d6f422b122922d1abee907d673bcc990e5f3672d"},{"fixed":"f2dc841d7dc9063fe9b47ced869b1271e55052ae"},{"fixed":"1cd927002120678bd5d23c760246639caa53040e"},{"fixed":"d7a076fb596c7b408ed6df74793a597990a6d860"},{"fixed":"178b9b570c0f75fa7e691490520328b20d19138e"},{"fixed":"ea6ec3343e05f7937a53eb6d7617b3abdb4abc19"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-64221.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.12.0"},{"fixed":"5.10.258"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.209"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.175"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.142"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.92"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.34"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.0.11"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-64221.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}