CVE-2026-23207

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23207", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.986Z", "datePublished": "2026-02-14T16:27:29.762Z", "dateUpdated": "2026-11-05T21:23:22.178Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:23:47.371Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: tegra210-quad: Protect curr_xfer check in IRQ handler\n\nNow that all other accesses to curr_xfer are done under the lock,\nprotect the curr_xfer NULL check in tegra_qspi_isr_thread() with the\nspinlock. Without this protection, the following race can occur:\n\n CPU0 (ISR thread) CPU1 (timeout path)\n ---------------- -------------------\n if (!tqspi->curr_xfer)\n // sees non-NULL\n spin_lock()\n tqspi->curr_xfer = NULL\n spin_unlock()\n handle_*_xfer()\n spin_lock()\n t = tqspi->curr_xfer // NULL!\n ... t->len ... // NULL dereference!\n\nWith this patch, all curr_xfer accesses are now properly synchronized.\n\nAlthough all accesses to curr_xfer are done under the lock, in\ntegra_qspi_isr_thread() it checks for NULL, releases the lock and\nreacquires it later in handle_cpu_based_xfer()/handle_dma_based_xfer().\nThere is a potential for an update in between, which could cause a NULL\npointer dereference.\n\nTo handle this, add a NULL check inside the handlers after acquiring\nthe lock. This ensures that if the timeout path has already cleared\ncurr_xfer, the handler will safely return without dereferencing the\nNULL pointer."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/spi/spi-tegra210-quad.c"], "versions": [{"version": "83309dd551cfd60a5a1a98d9cab19f435b44d46d", "lessThan": "8261fa3da6e9001be95a54b857df9759e9098d2f", "status": "affected", "versionType": "git"}, {"version": "c934e40246da2c5726d14e94719c514e30840df8", "lessThan": "513587caec66b67243027f26867ad3512f06744f", "status": "affected", "versionType": "git"}, {"version": "551060efb156c50fe33799038ba8145418cfdeef", "lessThan": "84e926c1c272a35ddb9b86842d32fa833a60dfc7", "status": "affected", "versionType": "git"}, {"version": "01bbf25c767219b14c3235bfa85906b8d2cb8fbc", "lessThan": "2ac3a105e51496147c0e44e49466eecfcc532d57", "status": "affected", "versionType": "git"}, {"version": "b4e002d8a7cee3b1d70efad0e222567f92a73000", "lessThan": "edf9088b6e1d6d88982db7eb5e736a0e4fbcc09e", "status": "affected", "versionType": "git"}, {"version": "88db8bb7ed1bb474618acdf05ebd4f0758d244e2", "status": "affected", "versionType": "git"}, {"version": "bb0c58be84f907285af45657c1d4847b960a12bf", "status": "affected", "versionType": "git"}, {"version": "5.15.198", "lessThan": "5.16", "status": "affected", "versionType": "semver"}, {"version": "6.17.13", "lessThan": "6.18", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/spi/spi-tegra210-quad.c"], "versions": [{"version": "6.1.160", "lessThan": "6.1.191", "status": "affected", "versionType": "semver"}, {"version": "6.6.120", "lessThan": "6.6.160", "status": "affected", "versionType": "semver"}, {"version": "6.12.63", "lessThan": "6.12.80", "status": "affected", "versionType": "semver"}, {"version": "6.18.2", "lessThan": "6.18.10", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.160", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.120", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.63", "versionEndExcluding": "6.12.80"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.2", "versionEndExcluding": "6.18.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.198"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17.13"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8261fa3da6e9001be95a54b857df9759e9098d2f"}, {"url": "https://git.kernel.org/stable/c/513587caec66b67243027f26867ad3512f06744f"}, {"url": "https://git.kernel.org/stable/c/84e926c1c272a35ddb9b86842d32fa833a60dfc7"}, {"url": "https://git.kernel.org/stable/c/2ac3a105e51496147c0e44e49466eecfcc532d57"}, {"url": "https://git.kernel.org/stable/c/edf9088b6e1d6d88982db7eb5e736a0e4fbcc09e"}], "title": "spi: tegra210-quad: Protect curr_xfer check in IRQ handler", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23207", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:22:22.485517Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:23:22.178Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23207", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:22:22.485517Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:22:24.197Z"}}], "cna": {"title": "spi: tegra210-quad: Protect curr_xfer check in IRQ handler", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "83309dd551cfd60a5a1a98d9cab19f435b44d46d", "lessThan": "8261fa3da6e9001be95a54b857df9759e9098d2f", "versionType": "git"}, {"status": "affected", "version": "c934e40246da2c5726d14e94719c514e30840df8", "lessThan": "513587caec66b67243027f26867ad3512f06744f", "versionType": "git"}, {"status": "affected", "version": "551060efb156c50fe33799038ba8145418cfdeef", "lessThan": "84e926c1c272a35ddb9b86842d32fa833a60dfc7", "versionType": "git"}, {"status": "affected", "version": "01bbf25c767219b14c3235bfa85906b8d2cb8fbc", "lessThan": "2ac3a105e51496147c0e44e49466eecfcc532d57", "versionType": "git"}, {"status": "affected", "version": "b4e002d8a7cee3b1d70efad0e222567f92a73000", "lessThan": "edf9088b6e1d6d88982db7eb5e736a0e4fbcc09e", "versionType": "git"}, {"status": "affected", "version": "88db8bb7ed1bb474618acdf05ebd4f0758d244e2", "versionType": "git"}, {"status": "affected", "version": "bb0c58be84f907285af45657c1d4847b960a12bf", "versionType": "git"}, {"status": "affected", "version": "5.15.198", "lessThan": "5.16", "versionType": "semver"}, {"status": "affected", "version": "6.17.13", "lessThan": "6.18", "versionType": "semver"}], "programFiles": ["drivers/spi/spi-tegra210-quad.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.1.160", "lessThan": "6.1.191", "versionType": "semver"}, {"status": "affected", "version": "6.6.120", "lessThan": "6.6.160", "versionType": "semver"}, {"status": "affected", "version": "6.12.63", "lessThan": "6.12.80", "versionType": "semver"}, {"status": "affected", "version": "6.18.2", "lessThan": "6.18.10", "versionType": "semver"}], "programFiles": ["drivers/spi/spi-tegra210-quad.c"], "defaultStatus": "unaffected"}], "references": [{"url": "https://git.kernel.org/stable/c/8261fa3da6e9001be95a54b857df9759e9098d2f"}, {"url": "https://git.kernel.org/stable/c/513587caec66b67243027f26867ad3512f06744f"}, {"url": "https://git.kernel.org/stable/c/84e926c1c272a35ddb9b86842d32fa833a60dfc7"}, {"url": "https://git.kernel.org/stable/c/2ac3a105e51496147c0e44e49466eecfcc532d57"}, {"url": "https://git.kernel.org/stable/c/edf9088b6e1d6d88982db7eb5e736a0e4fbcc09e"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: tegra210-quad: Protect curr_xfer check in IRQ handler\n\nNow that all other accesses to curr_xfer are done under the lock,\nprotect the curr_xfer NULL check in tegra_qspi_isr_thread() with the\nspinlock. Without this protection, the following race can occur:\n\n CPU0 (ISR thread) CPU1 (timeout path)\n ---------------- -------------------\n if (!tqspi->curr_xfer)\n // sees non-NULL\n spin_lock()\n tqspi->curr_xfer = NULL\n spin_unlock()\n handle_*_xfer()\n spin_lock()\n t = tqspi->curr_xfer // NULL!\n ... t->len ... // NULL dereference!\n\nWith this patch, all curr_xfer accesses are now properly synchronized.\n\nAlthough all accesses to curr_xfer are done under the lock, in\ntegra_qspi_isr_thread() it checks for NULL, releases the lock and\nreacquires it later in handle_cpu_based_xfer()/handle_dma_based_xfer().\nThere is a potential for an update in between, which could cause a NULL\npointer dereference.\n\nTo handle this, add a NULL check inside the handlers after acquiring\nthe lock. This ensures that if the timeout path has already cleared\ncurr_xfer, the handler will safely return without dereferencing the\nNULL pointer."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.191", "versionStartIncluding": "6.1.160"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.160", "versionStartIncluding": "6.6.120"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.80", "versionStartIncluding": "6.12.63"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.10", "versionStartIncluding": "6.18.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.15.198"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "6.17.13"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:23:47.371Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23207", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:23:22.178Z", "dateReserved": "2026-01-13T15:37:45.986Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-02-14T16:27:29.762Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/spi/spi-tegra210-quad.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8261fa3da6e9001be95a54b857df9759e9098d2f", "status": "affected", "version": "83309dd551cfd60a5a1a98d9cab19f435b44d46d", "versionType": "git"}, {"lessThan": "513587caec66b67243027f26867ad3512f06744f", "status": "affected", "version": "c934e40246da2c5726d14e94719c514e30840df8", "versionType": "git"}, {"lessThan": "84e926c1c272a35ddb9b86842d32fa833a60dfc7", "status": "affected", "version": "551060efb156c50fe33799038ba8145418cfdeef", "versionType": "git"}, {"lessThan": "2ac3a105e51496147c0e44e49466eecfcc532d57", "status": "affected", "version": "01bbf25c767219b14c3235bfa85906b8d2cb8fbc", "versionType": "git"}, {"lessThan": "edf9088b6e1d6d88982db7eb5e736a0e4fbcc09e", "status": "affected", "version": "b4e002d8a7cee3b1d70efad0e222567f92a73000", "versionType": "git"}, {"status": "affected", "version": "88db8bb7ed1bb474618acdf05ebd4f0758d244e2", "versionType": "git"}, {"status": "affected", "version": "bb0c58be84f907285af45657c1d4847b960a12bf", "versionType": "git"}, {"lessThan": "5.16", "status": "affected", "version": "5.15.198", "versionType": "semver"}, {"lessThan": "6.18", "status": "affected", "version": "6.17.13", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/spi/spi-tegra210-quad.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6.1.191", "status": "affected", "version": "6.1.160", "versionType": "semver"}, {"lessThan": "6.6.160", "status": "affected", "version": "6.6.120", "versionType": "semver"}, {"lessThan": "6.12.80", "status": "affected", "version": "6.12.63", "versionType": "semver"}, {"lessThan": "6.18.10", "status": "affected", "version": "6.18.2", "versionType": "semver"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "DAE43607-A681-44B2-AFC5-C3A01428F4B4", "versionEndExcluding": "5.16", "versionStartIncluding": "5.15.198", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "95004F71-D948-4577-8590-EF2413F4B63D", "versionEndExcluding": "6.2", "versionStartIncluding": "6.1.160", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "92DADBAB-4CEC-4775-8A77-A145264C5F80", "versionEndExcluding": "6.7", "versionStartIncluding": "6.6.120", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D41DF6E7-9FF0-4097-B10C-CFA7D39C4A5E", "versionEndExcluding": "6.13", "versionStartIncluding": "6.12.63", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7C298528-1754-41BD-B4E9-84A37AB7BA32", "versionEndExcluding": "6.18", "versionStartIncluding": "6.17.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0EF65418-FC18-4809-98E5-14B1A2C57DF8", "versionEndExcluding": "6.18.10", "versionStartIncluding": "6.18.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*", "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*", "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*", "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*", "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*", "matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*", "matchCriteriaId": "3EF854A1-ABB1-4E93-BE9A-44569EC76C0D", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*", "matchCriteriaId": "F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*", "matchCriteriaId": "EB5B7DFC-C36B-45D8-922C-877569FDDF43", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: tegra210-quad: Protect curr_xfer check in IRQ handler\n\nNow that all other accesses to curr_xfer are done under the lock,\nprotect the curr_xfer NULL check in tegra_qspi_isr_thread() with the\nspinlock. Without this protection, the following race can occur:\n\n CPU0 (ISR thread) CPU1 (timeout path)\n ---------------- -------------------\n if (!tqspi->curr_xfer)\n // sees non-NULL\n spin_lock()\n tqspi->curr_xfer = NULL\n spin_unlock()\n handle_*_xfer()\n spin_lock()\n t = tqspi->curr_xfer // NULL!\n ... t->len ... // NULL dereference!\n\nWith this patch, all curr_xfer accesses are now properly synchronized.\n\nAlthough all accesses to curr_xfer are done under the lock, in\ntegra_qspi_isr_thread() it checks for NULL, releases the lock and\nreacquires it later in handle_cpu_based_xfer()/handle_dma_based_xfer().\nThere is a potential for an update in between, which could cause a NULL\npointer dereference.\n\nTo handle this, add a NULL check inside the handlers after acquiring\nthe lock. This ensures that if the timeout path has already cleared\ncurr_xfer, the handler will safely return without dereferencing the\nNULL pointer."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nspi: tegra210-quad: Proteger la comprobaci\u00f3n de curr_xfer en el manejador IRQ\n\nAhora que todos los dem\u00e1s accesos a curr_xfer se realizan bajo el bloqueo, proteger la comprobaci\u00f3n de NULL de curr_xfer en tegra_qspi_isr_thread() con el spinlock. Sin esta protecci\u00f3n, la siguiente condici\u00f3n de carrera puede ocurrir:\n\n CPU0 (hilo ISR) CPU1 (ruta de tiempo de espera)\n ---------------- -------------------\n if (!tqspi->curr_xfer)\n // ve no-NULL\n spin_lock()\n tqspi->curr_xfer = NULL\n spin_unlock()\n handle_*_xfer()\n spin_lock()\n t = tqspi->curr_xfer // \u00a1NULL!\n ... t->len ... // \u00a1Desreferencia de NULL!\n\nCon este parche, todos los accesos a curr_xfer est\u00e1n ahora correctamente sincronizados.\n\nAunque todos los accesos a curr_xfer se realizan bajo el bloqueo, en tegra_qspi_isr_thread() comprueba si es NULL, libera el bloqueo y lo vuelve a adquirir m\u00e1s tarde en handle_cpu_based_xfer()/handle_dma_based_xfer(). Existe la posibilidad de una actualizaci\u00f3n intermedia, lo que podr\u00eda causar una desreferencia de puntero NULL.\n\nPara manejar esto, a\u00f1adir una comprobaci\u00f3n de NULL dentro de los manejadores despu\u00e9s de adquirir el bloqueo. Esto asegura que si la ruta de tiempo de espera ya ha limpiado curr_xfer, el manejador regresar\u00e1 de forma segura sin desreferenciar el puntero NULL."}], "id": "CVE-2026-23207", "lastModified": "2026-11-05T22:18:07.073", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23207", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:22:22.485517Z", "version": "2.0.3"}}]}, "published": "2026-02-14T17:15:58.610", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2ac3a105e51496147c0e44e49466eecfcc532d57"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/513587caec66b67243027f26867ad3512f06744f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8261fa3da6e9001be95a54b857df9759e9098d2f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/84e926c1c272a35ddb9b86842d32fa833a60dfc7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/edf9088b6e1d6d88982db7eb5e736a0e4fbcc09e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}, {"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: spi: tegra210-quad: Protect curr_xfer check in IRQ handler", "id": "2439897", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439897"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nspi: tegra210-quad: Protect curr_xfer check in IRQ handler\nNow that all other accesses to curr_xfer are done under the lock,\nprotect the curr_xfer NULL check in tegra_qspi_isr_thread() with the\nspinlock. Without this protection, the following race can occur:\nCPU0 (ISR thread) CPU1 (timeout path)\n---------------- -------------------\nif (!tqspi->curr_xfer)\n// sees non-NULL\nspin_lock()\ntqspi->curr_xfer = NULL\nspin_unlock()\nhandle_*_xfer()\nspin_lock()\nt = tqspi->curr_xfer // NULL!\n... t->len ... // NULL dereference!\nWith this patch, all curr_xfer accesses are now properly synchronized.\nAlthough all accesses to curr_xfer are done under the lock, in\ntegra_qspi_isr_thread() it checks for NULL, releases the lock and\nreacquires it later in handle_cpu_based_xfer()/handle_dma_based_xfer().\nThere is a potential for an update in between, which could cause a NULL\npointer dereference.\nTo handle this, add a NULL check inside the handlers after acquiring\nthe lock. This ensures that if the timeout path has already cleared\ncurr_xfer, the handler will safely return without dereferencing the\nNULL pointer."], "name": "CVE-2026-23207", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-02-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23207\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23207\nhttps://lore.kernel.org/linux-cve-announce/2026021438-CVE-2026-23207-a80c@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[01bbf25c767219b14c3235bfa85906b8d2cb8fbc,2ac3a105e51496147c0e44e49466eecfcc532d57)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b4e002d8a7cee3b1d70efad0e222567f92a73000,edf9088b6e1d6d88982db7eb5e736a0e4fbcc09e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "88db8bb7ed1bb474618acdf05ebd4f0758d244e2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "83309dd551cfd60a5a1a98d9cab19f435b44d46d"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "c934e40246da2c5726d14e94719c514e30840df8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "551060efb156c50fe33799038ba8145418cfdeef"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "bb0c58be84f907285af45657c1d4847b960a12bf"}}], "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.18.2,6.18.10)"}}], "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-15T20:28:07.560866+00:00", "value": {"mitigation_remediation": ["Upgrade the kernel to a version that includes the tegra210-quad ISR lock and NULL\u2011check patch (e.g., Linux kernel 6.19 rc9 or later).", "Verify that the patch commit (e.g., 2ac3a105e514...) is present in the running kernel by inspecting the source or using dmesg.", "If upgrading is not immediately possible, disable the tegra_qspi driver module or restrict SPI access until the patch is applied to prevent the race condition from occurring."], "summary": {"action": "Apply Patch", "impact": "Denial of Service (kernel crash caused by NULL pointer dereference)"}, "threat_synthesis": {"affected_systems": "Linux kernel versions 6.19 release candidates (rc1 through rc8) are affected. The issue exists in the tegra210-quad SPI driver and any system running those kernel versions on Tegra hardware. No specific vendor name is given beyond the Linux kernel.", "description_and_impact": "A race condition in the Linux tegra210-quad SPI driver allows the shared transfer pointer to become NULL while an interrupt handler still assumes it is valid, resulting in a NULL pointer dereference and a possible kernel panic. The flaw originates from unsynchronized access of the curr_xfer field during ISR processing and timeout handling, and the description clarifies that the patch adds locking and an additional NULL check to prevent this unsafe access. The vulnerability is a concurrency bug that leads to integrity and availability loss at the kernel level, but does not provide an attack vector for code execution or data exfiltration.", "risk_and_exploitability": "The CVSS score of 4.7 indicates a moderate severity, and the EPSS score of less than 1% reflects a very low probability of exploitation in the wild. The vulnerability is not listed in CISA\u2019s KEV catalog, suggesting no known public exploits. The likely attack vector is local and requires the attacker to trigger the race condition by initiating SPI transfers and causing a timeout on a Tegra platform. The impact is limited to a kernel crash, which would bring the operating system down. The overall risk remains moderate due to the low exploitation likelihood and the need for local, privileged access to exploit the race."}}}}, "created": "2026-02-16T09:43:24.894286+00:00", "updated": "2026-04-15T20:30:13.782799+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}