{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-26807", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.179Z", "datePublished": "2024-04-04T08:20:34.155Z", "dateUpdated": "2026-08-05T11:27:25.924Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:27:25.924Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBoth cadence-quadspi ->runtime_suspend() and ->runtime_resume()\nimplementations start with:\n\n\tstruct cqspi_st *cqspi = dev_get_drvdata(dev);\n\tstruct spi_controller *host = dev_get_drvdata(dev);\n\nThis obviously cannot be correct, unless \"struct cqspi_st\" is the\nfirst member of \" struct spi_controller\", or the other way around, but\nit is not the case. \"struct spi_controller\" is allocated by\ndevm_spi_alloc_host(), which allocates an extra amount of memory for\nprivate data, used to store \"struct cqspi_st\".\n\nThe ->probe() function of the cadence-quadspi driver then sets the\ndevice drvdata to store the address of the \"struct cqspi_st\"\nstructure. Therefore:\n\n\tstruct cqspi_st *cqspi = dev_get_drvdata(dev);\n\nis correct, but:\n\n\tstruct spi_controller *host = dev_get_drvdata(dev);\n\nis not, as it makes \"host\" point not to a \"struct spi_controller\" but\nto the same \"struct cqspi_st\" structure as above.\n\nThis obviously leads to bad things (memory corruption, kernel crashes)\ndirectly during ->probe(), as ->probe() enables the device using PM\nruntime, leading the ->runtime_resume() hook being called, which in\nturns calls spi_controller_resume() with the wrong pointer.\n\nThis has at least been reported [0] to cause a kernel crash, but the\nexact behavior will depend on the memory contents.\n\n[0] https://lore.kernel.org/all/20240226121803.5a7r5wkpbbowcxgx@dhruva/\n\nThis issue potentially affects all platforms that are currently using\nthe cadence-quadspi driver." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is the runtime-PM hook of an on-SoC Cadence QSPI controller driver, reached through local flash I/O (MTD/mtdblock access driving `cqspi_exec_mem_op()` → `pm_runtime_resume_and_get()`) or the autosuspend timer. There is no network or remote-peer input path into this driver.\nAC:L - The wrong pointer is passed unconditionally on every suspend and resume, so the corrupting code path executes deterministically at probe time and on each runtime-PM transition; no race, timing window, or uncontrolled precondition needs to be won.\nPR:L - Any unprivileged local process can drive the cycle by touching a file on the flash-backed filesystem and then idling for the 2-second autosuspend timeout; no capability, CAP_SYS_ADMIN, or device-node ownership check exists anywhere along `cqspi_exec_mem_op()` → runtime PM → `cqspi_suspend()/cqspi_resume()`.\nUI:N - Autosuspend/resume transitions occur automatically from normal device activity and the 2 s idle timer, and the corruption already happens during probe; no victim action of any kind is required.\nS:U - The corruption is confined to kernel slab memory and the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a type confusion in which `struct cqspi_st` is treated as `struct spi_controller`, causing reads and writes at offsets (`bus_lock_mutex` ~930B, `queued`, `kworker`) that fall into `f_pdata` or past the end of the `devm_spi_alloc_host()` allocation; such heap corruption with a groomable adjacent object can be leveraged into an arbitrary-read primitive.\nI:H - Type confusion with out-of-bounds writes — `ctlr->flags |=`, the mutex owner word, and `list_add_tail()` on an uninitialised `wait_list` in the mutex slowpath — plus `kthread_queue_work()` on a garbage `ctlr->kworker` pointer, gives write and control-flow corruption primitives rather than a benign fault.\nA:H - The upstream fix and the linked bug report document kernel crashes and memory corruption during probe; `mutex_lock()` on uninitialised memory can also hang the task indefinitely, and the path can be re-triggered repeatedly by an unprivileged user." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/spi/spi-cadence-quadspi.c" ], "versions": [ { "version": "79acf7fb856eade9c3d0cf00fd34a04bf5c43a1c", "lessThan": "2c914aac9522f6e93822c18dff233d3e92399c81", "status": "affected", "versionType": "git" }, { "version": "2087e85bb66ee3652dafe732bb9b9b896229eafc", "lessThan": "03f1573c9587029730ca68503f5062105b122f61", "status": "affected", "versionType": "git" }, { "version": "2087e85bb66ee3652dafe732bb9b9b896229eafc", "lessThan": "34e1d5c4407c78de0e3473e1fbf8fb74dbe66d03", "status": "affected", "versionType": "git" }, { "version": "2087e85bb66ee3652dafe732bb9b9b896229eafc", "lessThan": "32ce3bb57b6b402de2aec1012511e7ac4e7449dc", "status": "affected", "versionType": "git" }, { "version": "e3f9fc9a4f1499cc9e1bad4482d377494e367b3d", "status": "affected", "versionType": "git" }, { "version": "6716203844bc8489af5e5564f0fa31e0c094a7ff", "status": "affected", "versionType": "git" }, { "version": "b24f1ecc8fe2ceefc14af02edb1744c246d87bf7", "status": "affected", "versionType": "git" }, { "version": "d453f25faf681799d636fe9d6899ad91c45aa11e", "status": "affected", "versionType": "git" }, { "version": "18cb554e9da81bc4eca653c17a0d65e8b5835c09", "status": "affected", "versionType": "git" }, { "version": "1368dbc0a432acf9fc0dcb23bfe52d32ca4c09ab", "status": "affected", "versionType": "git" }, { "version": "6.1.28", "lessThan": "6.1.140", "status": "affected", "versionType": "semver" }, { "version": "4.19.283", "lessThan": "4.20", "status": "affected", "versionType": "semver" }, { "version": "5.4.243", "lessThan": "5.5", "status": "affected", "versionType": "semver" }, { "version": "5.10.180", "lessThan": "5.11", "status": "affected", "versionType": "semver" }, { "version": "5.15.111", "lessThan": "5.16", "status": "affected", "versionType": "semver" }, { "version": "6.2.15", "lessThan": "6.3", "status": "affected", "versionType": "semver" }, { "version": "6.3.2", "lessThan": "6.4", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/spi/spi-cadence-quadspi.c" ], "versions": [ { "version": "6.4", "status": "affected" }, { "version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.140", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.21", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.7.9", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.28", "versionEndExcluding": "6.1.140" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.21" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.7.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.8" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.283" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.243" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.180" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.111" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2.15" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/2c914aac9522f6e93822c18dff233d3e92399c81" }, { "url": "https://git.kernel.org/stable/c/03f1573c9587029730ca68503f5062105b122f61" }, { "url": "https://git.kernel.org/stable/c/34e1d5c4407c78de0e3473e1fbf8fb74dbe66d03" }, { "url": "https://git.kernel.org/stable/c/32ce3bb57b6b402de2aec1012511e7ac4e7449dc" } ], "title": "spi: cadence-qspi: fix pointer reference in runtime PM hooks", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/03f1573c9587029730ca68503f5062105b122f61", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/34e1d5c4407c78de0e3473e1fbf8fb74dbe66d03", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/32ce3bb57b6b402de2aec1012511e7ac4e7449dc", "tags": [ "x_transferred" ] }, { "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:29:35.945Z" } }, { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-26807", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T15:50:43.187812Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:46.008Z" } } ] } }