GHSA-PV8G-5QG3-Q63W
Vulnerability from github – Published: 2026-08-15 06:32 – Updated: 2026-08-17 06:33In the Linux kernel, the following vulnerability has been resolved:
spi: imx: reconfigure for PIO when DMA cannot be started
When spi_imx_can_dma() selects DMA, the ECSPI is configured for DMA: spi_imx_setupxfer() sets CTRL.SMC and clears dynamic_burst, and spi_imx_dma_transfer() programs the dynamic-burst BURST_LENGTH and the SDMA watermarks.
If the DMA descriptor cannot be prepared (dmaengine_prep_slave_single() returns NULL), the transfer is failed with SPI_TRANS_FAIL_NO_START and falls back to PIO. The dynamic-burst DMA path uses its own bounce buffers instead of the SPI core's mapping, so xfer->{tx,rx}_sg_mapped are not set and the core's DMA->PIO retry is skipped; the driver falls back to PIO internally. But none of the DMA-mode configuration is undone, so the PIO transfer runs with CTRL.SMC set, the wrong burst length and dynamic_burst cleared, and the transferred data is corrupted.
This is easily hit on i.MX8MP boards that describe ECSPI DMA in the device tree but run SDMA on ROM firmware (no external sdma-imx7d.bin): every ECSPI DMA prepare fails. An Infineon SLB9670 TPM on ECSPI1 then returns shifted TPM2_GetCapability data, is flagged "field failure mode", /dev/tpmrm0 is never created.
Set controller->fallback before re-running spi_imx_setupxfer() so the ECSPI is reconfigured exactly like a normal PIO transfer. With controller->fallback set, spi_imx_setupxfer() sees spi_imx_can_dma() return false, so it clears spi_imx->usedma and reprograms the controller (clears CTRL.SMC, restores dynamic_burst and the PIO burst length). No explicit spi_imx->usedma = false is needed: setupxfer() already updates it from the can_dma() result.
{
"affected": [],
"aliases": [
"CVE-2026-72134"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-15T06:21:30Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: imx: reconfigure for PIO when DMA cannot be started\n\nWhen spi_imx_can_dma() selects DMA, the ECSPI is configured for DMA:\nspi_imx_setupxfer() sets CTRL.SMC and clears dynamic_burst, and\nspi_imx_dma_transfer() programs the dynamic-burst BURST_LENGTH and the\nSDMA watermarks.\n\nIf the DMA descriptor cannot be prepared (dmaengine_prep_slave_single()\nreturns NULL), the transfer is failed with SPI_TRANS_FAIL_NO_START and\nfalls back to PIO. The dynamic-burst DMA path uses its own bounce\nbuffers instead of the SPI core\u0027s mapping, so xfer-\u003e{tx,rx}_sg_mapped\nare not set and the core\u0027s DMA-\u003ePIO retry is skipped; the driver falls\nback to PIO internally. But none of the DMA-mode configuration is\nundone, so the PIO transfer runs with CTRL.SMC set, the wrong burst\nlength and dynamic_burst cleared, and the transferred data is corrupted.\n\nThis is easily hit on i.MX8MP boards that describe ECSPI DMA in the\ndevice tree but run SDMA on ROM firmware (no external sdma-imx7d.bin):\nevery ECSPI DMA prepare fails. An Infineon SLB9670 TPM on ECSPI1 then\nreturns shifted TPM2_GetCapability data, is flagged \"field failure\nmode\", /dev/tpmrm0 is never created.\n\nSet controller-\u003efallback before re-running spi_imx_setupxfer() so the\nECSPI is reconfigured exactly like a normal PIO transfer. With\ncontroller-\u003efallback set, spi_imx_setupxfer() sees spi_imx_can_dma()\nreturn false, so it clears spi_imx-\u003eusedma and reprograms the controller\n(clears CTRL.SMC, restores dynamic_burst and the PIO burst length). No\nexplicit spi_imx-\u003eusedma = false is needed: setupxfer() already updates\nit from the can_dma() result.",
"id": "GHSA-pv8g-5qg3-q63w",
"modified": "2026-08-17T06:33:12Z",
"published": "2026-08-15T06:32:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72134"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/245404c26563aafb36aafb01298f148db1851be3"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/40dee2d3e9994aed9efe7bed40eb0e4d38d5a25c"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.