CVE-2024-26807

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-26807", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.179Z", "datePublished": "2024-04-04T08:20:34.155Z", "dateUpdated": "2026-08-05T11:27:25.924Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:27:25.924Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBoth cadence-quadspi ->runtime_suspend() and ->runtime_resume()\nimplementations start with:\n\n\tstruct cqspi_st *cqspi = dev_get_drvdata(dev);\n\tstruct spi_controller *host = dev_get_drvdata(dev);\n\nThis obviously cannot be correct, unless \"struct cqspi_st\" is the\nfirst member of \" struct spi_controller\", or the other way around, but\nit is not the case. \"struct spi_controller\" is allocated by\ndevm_spi_alloc_host(), which allocates an extra amount of memory for\nprivate data, used to store \"struct cqspi_st\".\n\nThe ->probe() function of the cadence-quadspi driver then sets the\ndevice drvdata to store the address of the \"struct cqspi_st\"\nstructure. Therefore:\n\n\tstruct cqspi_st *cqspi = dev_get_drvdata(dev);\n\nis correct, but:\n\n\tstruct spi_controller *host = dev_get_drvdata(dev);\n\nis not, as it makes \"host\" point not to a \"struct spi_controller\" but\nto the same \"struct cqspi_st\" structure as above.\n\nThis obviously leads to bad things (memory corruption, kernel crashes)\ndirectly during ->probe(), as ->probe() enables the device using PM\nruntime, leading the ->runtime_resume() hook being called, which in\nturns calls spi_controller_resume() with the wrong pointer.\n\nThis has at least been reported [0] to cause a kernel crash, but the\nexact behavior will depend on the memory contents.\n\n[0] https://lore.kernel.org/all/20240226121803.5a7r5wkpbbowcxgx@dhruva/\n\nThis issue potentially affects all platforms that are currently using\nthe cadence-quadspi driver."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is the runtime-PM hook of an on-SoC Cadence QSPI controller driver, reached through local flash I/O (MTD/mtdblock access driving `cqspi_exec_mem_op()` \u2192 `pm_runtime_resume_and_get()`) or the autosuspend timer. There is no network or remote-peer input path into this driver.\nAC:L - The wrong pointer is passed unconditionally on every suspend and resume, so the corrupting code path executes deterministically at probe time and on each runtime-PM transition; no race, timing window, or uncontrolled precondition needs to be won.\nPR:L - Any unprivileged local process can drive the cycle by touching a file on the flash-backed filesystem and then idling for the 2-second autosuspend timeout; no capability, CAP_SYS_ADMIN, or device-node ownership check exists anywhere along `cqspi_exec_mem_op()` \u2192 runtime PM \u2192 `cqspi_suspend()/cqspi_resume()`.\nUI:N - Autosuspend/resume transitions occur automatically from normal device activity and the 2 s idle timer, and the corruption already happens during probe; no victim action of any kind is required.\nS:U - The corruption is confined to kernel slab memory and the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a type confusion in which `struct cqspi_st` is treated as `struct spi_controller`, causing reads and writes at offsets (`bus_lock_mutex` ~930B, `queued`, `kworker`) that fall into `f_pdata` or past the end of the `devm_spi_alloc_host()` allocation; such heap corruption with a groomable adjacent object can be leveraged into an arbitrary-read primitive.\nI:H - Type confusion with out-of-bounds writes \u2014 `ctlr->flags |=`, the mutex owner word, and `list_add_tail()` on an uninitialised `wait_list` in the mutex slowpath \u2014 plus `kthread_queue_work()` on a garbage `ctlr->kworker` pointer, gives write and control-flow corruption primitives rather than a benign fault.\nA:H - The upstream fix and the linked bug report document kernel crashes and memory corruption during probe; `mutex_lock()` on uninitialised memory can also hang the task indefinitely, and the path can be re-triggered repeatedly by an unprivileged user."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/spi/spi-cadence-quadspi.c"], "versions": [{"version": "79acf7fb856eade9c3d0cf00fd34a04bf5c43a1c", "lessThan": "2c914aac9522f6e93822c18dff233d3e92399c81", "status": "affected", "versionType": "git"}, {"version": "2087e85bb66ee3652dafe732bb9b9b896229eafc", "lessThan": "03f1573c9587029730ca68503f5062105b122f61", "status": "affected", "versionType": "git"}, {"version": "2087e85bb66ee3652dafe732bb9b9b896229eafc", "lessThan": "34e1d5c4407c78de0e3473e1fbf8fb74dbe66d03", "status": "affected", "versionType": "git"}, {"version": "2087e85bb66ee3652dafe732bb9b9b896229eafc", "lessThan": "32ce3bb57b6b402de2aec1012511e7ac4e7449dc", "status": "affected", "versionType": "git"}, {"version": "e3f9fc9a4f1499cc9e1bad4482d377494e367b3d", "status": "affected", "versionType": "git"}, {"version": "6716203844bc8489af5e5564f0fa31e0c094a7ff", "status": "affected", "versionType": "git"}, {"version": "b24f1ecc8fe2ceefc14af02edb1744c246d87bf7", "status": "affected", "versionType": "git"}, {"version": "d453f25faf681799d636fe9d6899ad91c45aa11e", "status": "affected", "versionType": "git"}, {"version": "18cb554e9da81bc4eca653c17a0d65e8b5835c09", "status": "affected", "versionType": "git"}, {"version": "1368dbc0a432acf9fc0dcb23bfe52d32ca4c09ab", "status": "affected", "versionType": "git"}, {"version": "6.1.28", "lessThan": "6.1.140", "status": "affected", "versionType": "semver"}, {"version": "4.19.283", "lessThan": "4.20", "status": "affected", "versionType": "semver"}, {"version": "5.4.243", "lessThan": "5.5", "status": "affected", "versionType": "semver"}, {"version": "5.10.180", "lessThan": "5.11", "status": "affected", "versionType": "semver"}, {"version": "5.15.111", "lessThan": "5.16", "status": "affected", "versionType": "semver"}, {"version": "6.2.15", "lessThan": "6.3", "status": "affected", "versionType": "semver"}, {"version": "6.3.2", "lessThan": "6.4", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/spi/spi-cadence-quadspi.c"], "versions": [{"version": "6.4", "status": "affected"}, {"version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.140", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.21", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.9", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.28", "versionEndExcluding": "6.1.140"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.7.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.283"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.243"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.180"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2.15"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/2c914aac9522f6e93822c18dff233d3e92399c81"}, {"url": "https://git.kernel.org/stable/c/03f1573c9587029730ca68503f5062105b122f61"}, {"url": "https://git.kernel.org/stable/c/34e1d5c4407c78de0e3473e1fbf8fb74dbe66d03"}, {"url": "https://git.kernel.org/stable/c/32ce3bb57b6b402de2aec1012511e7ac4e7449dc"}], "title": "spi: cadence-qspi: fix pointer reference in runtime PM hooks", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/03f1573c9587029730ca68503f5062105b122f61", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/34e1d5c4407c78de0e3473e1fbf8fb74dbe66d03", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/32ce3bb57b6b402de2aec1012511e7ac4e7449dc", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:29:35.945Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26807", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:50:43.187812Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:46.008Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/03f1573c9587029730ca68503f5062105b122f61", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/34e1d5c4407c78de0e3473e1fbf8fb74dbe66d03", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/32ce3bb57b6b402de2aec1012511e7ac4e7449dc", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:29:35.945Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26807", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:50:43.187812Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:18.545Z"}}], "cna": {"title": "spi: cadence-qspi: fix pointer reference in runtime PM hooks", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is the runtime-PM hook of an on-SoC Cadence QSPI controller driver, reached through local flash I/O (MTD/mtdblock access driving `cqspi_exec_mem_op()` \u2192 `pm_runtime_resume_and_get()`) or the autosuspend timer. There is no network or remote-peer input path into this driver.\nAC:L - The wrong pointer is passed unconditionally on every suspend and resume, so the corrupting code path executes deterministically at probe time and on each runtime-PM transition; no race, timing window, or uncontrolled precondition needs to be won.\nPR:L - Any unprivileged local process can drive the cycle by touching a file on the flash-backed filesystem and then idling for the 2-second autosuspend timeout; no capability, CAP_SYS_ADMIN, or device-node ownership check exists anywhere along `cqspi_exec_mem_op()` \u2192 runtime PM \u2192 `cqspi_suspend()/cqspi_resume()`.\nUI:N - Autosuspend/resume transitions occur automatically from normal device activity and the 2 s idle timer, and the corruption already happens during probe; no victim action of any kind is required.\nS:U - The corruption is confined to kernel slab memory and the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a type confusion in which `struct cqspi_st` is treated as `struct spi_controller`, causing reads and writes at offsets (`bus_lock_mutex` ~930B, `queued`, `kworker`) that fall into `f_pdata` or past the end of the `devm_spi_alloc_host()` allocation; such heap corruption with a groomable adjacent object can be leveraged into an arbitrary-read primitive.\nI:H - Type confusion with out-of-bounds writes \u2014 `ctlr->flags |=`, the mutex owner word, and `list_add_tail()` on an uninitialised `wait_list` in the mutex slowpath \u2014 plus `kthread_queue_work()` on a garbage `ctlr->kworker` pointer, gives write and control-flow corruption primitives rather than a benign fault.\nA:H - The upstream fix and the linked bug report document kernel crashes and memory corruption during probe; `mutex_lock()` on uninitialised memory can also hang the task indefinitely, and the path can be re-triggered repeatedly by an unprivileged user."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "79acf7fb856eade9c3d0cf00fd34a04bf5c43a1c", "lessThan": "2c914aac9522f6e93822c18dff233d3e92399c81", "versionType": "git"}, {"status": "affected", "version": "2087e85bb66ee3652dafe732bb9b9b896229eafc", "lessThan": "03f1573c9587029730ca68503f5062105b122f61", "versionType": "git"}, {"status": "affected", "version": "2087e85bb66ee3652dafe732bb9b9b896229eafc", "lessThan": "34e1d5c4407c78de0e3473e1fbf8fb74dbe66d03", "versionType": "git"}, {"status": "affected", "version": "2087e85bb66ee3652dafe732bb9b9b896229eafc", "lessThan": "32ce3bb57b6b402de2aec1012511e7ac4e7449dc", "versionType": "git"}, {"status": "affected", "version": "e3f9fc9a4f1499cc9e1bad4482d377494e367b3d", "versionType": "git"}, {"status": "affected", "version": "6716203844bc8489af5e5564f0fa31e0c094a7ff", "versionType": "git"}, {"status": "affected", "version": "b24f1ecc8fe2ceefc14af02edb1744c246d87bf7", "versionType": "git"}, {"status": "affected", "version": "d453f25faf681799d636fe9d6899ad91c45aa11e", "versionType": "git"}, {"status": "affected", "version": "18cb554e9da81bc4eca653c17a0d65e8b5835c09", "versionType": "git"}, {"status": "affected", "version": "1368dbc0a432acf9fc0dcb23bfe52d32ca4c09ab", "versionType": "git"}, {"status": "affected", "version": "6.1.28", "lessThan": "6.1.140", "versionType": "semver"}, {"status": "affected", "version": "4.19.283", "lessThan": "4.20", "versionType": "semver"}, {"status": "affected", "version": "5.4.243", "lessThan": "5.5", "versionType": "semver"}, {"status": "affected", "version": "5.10.180", "lessThan": "5.11", "versionType": "semver"}, {"status": "affected", "version": "5.15.111", "lessThan": "5.16", "versionType": "semver"}, {"status": "affected", "version": "6.2.15", "lessThan": "6.3", "versionType": "semver"}, {"status": "affected", "version": "6.3.2", "lessThan": "6.4", "versionType": "semver"}], "programFiles": ["drivers/spi/spi-cadence-quadspi.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.4"}, {"status": "unaffected", "version": "0", "lessThan": "6.4", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.140", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.21", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.9", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/spi/spi-cadence-quadspi.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/2c914aac9522f6e93822c18dff233d3e92399c81"}, {"url": "https://git.kernel.org/stable/c/03f1573c9587029730ca68503f5062105b122f61"}, {"url": "https://git.kernel.org/stable/c/34e1d5c4407c78de0e3473e1fbf8fb74dbe66d03"}, {"url": "https://git.kernel.org/stable/c/32ce3bb57b6b402de2aec1012511e7ac4e7449dc"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBoth cadence-quadspi ->runtime_suspend() and ->runtime_resume()\nimplementations start with:\n\n\tstruct cqspi_st *cqspi = dev_get_drvdata(dev);\n\tstruct spi_controller *host = dev_get_drvdata(dev);\n\nThis obviously cannot be correct, unless \"struct cqspi_st\" is the\nfirst member of \" struct spi_controller\", or the other way around, but\nit is not the case. \"struct spi_controller\" is allocated by\ndevm_spi_alloc_host(), which allocates an extra amount of memory for\nprivate data, used to store \"struct cqspi_st\".\n\nThe ->probe() function of the cadence-quadspi driver then sets the\ndevice drvdata to store the address of the \"struct cqspi_st\"\nstructure. Therefore:\n\n\tstruct cqspi_st *cqspi = dev_get_drvdata(dev);\n\nis correct, but:\n\n\tstruct spi_controller *host = dev_get_drvdata(dev);\n\nis not, as it makes \"host\" point not to a \"struct spi_controller\" but\nto the same \"struct cqspi_st\" structure as above.\n\nThis obviously leads to bad things (memory corruption, kernel crashes)\ndirectly during ->probe(), as ->probe() enables the device using PM\nruntime, leading the ->runtime_resume() hook being called, which in\nturns calls spi_controller_resume() with the wrong pointer.\n\nThis has at least been reported [0] to cause a kernel crash, but the\nexact behavior will depend on the memory contents.\n\n[0] https://lore.kernel.org/all/20240226121803.5a7r5wkpbbowcxgx@dhruva/\n\nThis issue potentially affects all platforms that are currently using\nthe cadence-quadspi driver."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.140", "versionStartIncluding": "6.1.28"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.21", "versionStartIncluding": "6.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.9", "versionStartIncluding": "6.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8", "versionStartIncluding": "6.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.19.283"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.4.243"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.10.180"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.15.111"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "6.2.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "6.3.2"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:27:25.924Z"}}}, "cveMetadata": {"cveId": "CVE-2024-26807", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:27:25.924Z", "dateReserved": "2024-02-19T14:20:24.179Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-04-04T08:20:34.155Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/spi/spi-cadence-quadspi.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "2c914aac9522f6e93822c18dff233d3e92399c81", "status": "affected", "version": "79acf7fb856eade9c3d0cf00fd34a04bf5c43a1c", "versionType": "git"}, {"lessThan": "03f1573c9587029730ca68503f5062105b122f61", "status": "affected", "version": "2087e85bb66ee3652dafe732bb9b9b896229eafc", "versionType": "git"}, {"lessThan": "34e1d5c4407c78de0e3473e1fbf8fb74dbe66d03", "status": "affected", "version": "2087e85bb66ee3652dafe732bb9b9b896229eafc", "versionType": "git"}, {"lessThan": "32ce3bb57b6b402de2aec1012511e7ac4e7449dc", "status": "affected", "version": "2087e85bb66ee3652dafe732bb9b9b896229eafc", "versionType": "git"}, {"status": "affected", "version": "e3f9fc9a4f1499cc9e1bad4482d377494e367b3d", "versionType": "git"}, {"status": "affected", "version": "6716203844bc8489af5e5564f0fa31e0c094a7ff", "versionType": "git"}, {"status": "affected", "version": "b24f1ecc8fe2ceefc14af02edb1744c246d87bf7", "versionType": "git"}, {"status": "affected", "version": "d453f25faf681799d636fe9d6899ad91c45aa11e", "versionType": "git"}, {"status": "affected", "version": "18cb554e9da81bc4eca653c17a0d65e8b5835c09", "versionType": "git"}, {"status": "affected", "version": "1368dbc0a432acf9fc0dcb23bfe52d32ca4c09ab", "versionType": "git"}, {"lessThan": "6.1.140", "status": "affected", "version": "6.1.28", "versionType": "semver"}, {"lessThan": "4.20", "status": "affected", "version": "4.19.283", "versionType": "semver"}, {"lessThan": "5.5", "status": "affected", "version": "5.4.243", "versionType": "semver"}, {"lessThan": "5.11", "status": "affected", "version": "5.10.180", "versionType": "semver"}, {"lessThan": "5.16", "status": "affected", "version": "5.15.111", "versionType": "semver"}, {"lessThan": "6.3", "status": "affected", "version": "6.2.15", "versionType": "semver"}, {"lessThan": "6.4", "status": "affected", "version": "6.3.2", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/spi/spi-cadence-quadspi.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.4"}, {"lessThan": "6.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.140", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.21", "versionType": "semver"}, {"lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "584D76D2-1164-4D5F-A720-182A249B363A", "versionEndExcluding": "6.6.21", "versionStartIncluding": "6.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1C538467-EDA0-4A9A-82EB-2925DE9FF827", "versionEndExcluding": "6.7.9", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:4.19.283:*:*:*:*:*:*:*", "matchCriteriaId": "D218D46E-9A95-4C75-A4D1-2C8957EFF613", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.4.243:*:*:*:*:*:*:*", "matchCriteriaId": "1F43B313-8B49-45C5-BA3F-43A00C1ABFDF", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.10.180:*:*:*:*:*:*:*", "matchCriteriaId": "E57BBF5A-3C2F-4683-90E9-C55C20DA0392", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.15.111:*:*:*:*:*:*:*", "matchCriteriaId": "B8400C3E-16EB-4BE1-BFF2-F165B9C6C2DA", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1.28:*:*:*:*:*:*:*", "matchCriteriaId": "063461C2-6DB7-4D4D-90A5-FF26944C693A", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.2.15:*:*:*:*:*:*:*", "matchCriteriaId": "4CB13E07-8733-47AA-B47A-ABC9AA44E4F5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.3.2:*:*:*:*:*:*:*", "matchCriteriaId": "7E9ED291-2EE9-4BE1-8925-FD7F622D1012", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*", "matchCriteriaId": "B9F4EA73-0894-400F-A490-3A397AB7A517", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*", "matchCriteriaId": "056BD938-0A27-4569-B391-30578B309EE3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*", "matchCriteriaId": "F02056A5-B362-4370-9FF8-6F0BD384D520", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*", "matchCriteriaId": "62075ACE-B2A0-4B16-829D-B3DA5AE5CC41", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*", "matchCriteriaId": "A780F817-2A77-4130-A9B7-5C25606314E3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:*", "matchCriteriaId": "AEB9199B-AB8F-4877-8964-E2BA95B5F15C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBoth cadence-quadspi ->runtime_suspend() and ->runtime_resume()\nimplementations start with:\n\n\tstruct cqspi_st *cqspi = dev_get_drvdata(dev);\n\tstruct spi_controller *host = dev_get_drvdata(dev);\n\nThis obviously cannot be correct, unless \"struct cqspi_st\" is the\nfirst member of \" struct spi_controller\", or the other way around, but\nit is not the case. \"struct spi_controller\" is allocated by\ndevm_spi_alloc_host(), which allocates an extra amount of memory for\nprivate data, used to store \"struct cqspi_st\".\n\nThe ->probe() function of the cadence-quadspi driver then sets the\ndevice drvdata to store the address of the \"struct cqspi_st\"\nstructure. Therefore:\n\n\tstruct cqspi_st *cqspi = dev_get_drvdata(dev);\n\nis correct, but:\n\n\tstruct spi_controller *host = dev_get_drvdata(dev);\n\nis not, as it makes \"host\" point not to a \"struct spi_controller\" but\nto the same \"struct cqspi_st\" structure as above.\n\nThis obviously leads to bad things (memory corruption, kernel crashes)\ndirectly during ->probe(), as ->probe() enables the device using PM\nruntime, leading the ->runtime_resume() hook being called, which in\nturns calls spi_controller_resume() with the wrong pointer.\n\nThis has at least been reported [0] to cause a kernel crash, but the\nexact behavior will depend on the memory contents.\n\n[0] https://lore.kernel.org/all/20240226121803.5a7r5wkpbbowcxgx@dhruva/\n\nThis issue potentially affects all platforms that are currently using\nthe cadence-quadspi driver."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: spi: cadence-qspi: corrige la referencia del puntero en los ganchos PM en tiempo de ejecuci\u00f3n dev_get_drvdata() se utiliza para adquirir el puntero a cqspi y el controlador SPI. Ninguno de los dos integra al otro; Esto conduce a la corrupci\u00f3n de la memoria. En una plataforma determinada (Mobileye EyeQ5), la corrupci\u00f3n de la memoria est\u00e1 oculta dentro de cqspi->f_pdata. Adem\u00e1s, esta memoria no inicializada se utiliza como mutex (ctlr->bus_lock_mutex) por spi_controller_suspend()."}], "id": "CVE-2024-26807", "lastModified": "2026-08-04T11:17:07.950", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-26807", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T15:50:43.187812Z", "version": "2.0.3"}}]}, "published": "2024-04-04T09:15:09.380", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/03f1573c9587029730ca68503f5062105b122f61"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2c914aac9522f6e93822c18dff233d3e92399c81"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/32ce3bb57b6b402de2aec1012511e7ac4e7449dc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/34e1d5c4407c78de0e3473e1fbf8fb74dbe66d03"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/03f1573c9587029730ca68503f5062105b122f61"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/32ce3bb57b6b402de2aec1012511e7ac4e7449dc"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/34e1d5c4407c78de0e3473e1fbf8fb74dbe66d03"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: spi: cadence-qspi: fix pointer reference in runtime PM hooks", "id": "2273416", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2273416"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-822", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nBoth cadence-quadspi ->runtime_suspend() and ->runtime_resume()\nimplementations start with:\nstruct cqspi_st *cqspi = dev_get_drvdata(dev);\nstruct spi_controller *host = dev_get_drvdata(dev);\nThis obviously cannot be correct, unless \"struct cqspi_st\" is the\nfirst member of \" struct spi_controller\", or the other way around, but\nit is not the case. \"struct spi_controller\" is allocated by\ndevm_spi_alloc_host(), which allocates an extra amount of memory for\nprivate data, used to store \"struct cqspi_st\".\nThe ->probe() function of the cadence-quadspi driver then sets the\ndevice drvdata to store the address of the \"struct cqspi_st\"\nstructure. Therefore:\nstruct cqspi_st *cqspi = dev_get_drvdata(dev);\nis correct, but:\nstruct spi_controller *host = dev_get_drvdata(dev);\nis not, as it makes \"host\" point not to a \"struct spi_controller\" but\nto the same \"struct cqspi_st\" structure as above.\nThis obviously leads to bad things (memory corruption, kernel crashes)\ndirectly during ->probe(), as ->probe() enables the device using PM\nruntime, leading the ->runtime_resume() hook being called, which in\nturns calls spi_controller_resume() with the wrong pointer.\nThis has at least been reported [0] to cause a kernel crash, but the\nexact behavior will depend on the memory contents.\n[0] https://lore.kernel.org/all/20240226121803.5a7r5wkpbbowcxgx@dhruva/\nThis issue potentially affects all platforms that are currently using\nthe cadence-quadspi driver.", "A vulnerability was found in the Cadence Quad SPI (cadence-qspi driver) in the Linux kernel. Improper pointer reference handling in the runtime Power Management (PM) hooks could lead to system instability or potential security risks."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-26807", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-04-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-26807\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-26807"], "statement": "Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.", "threat_severity": "Moderate"}

{}