CVE-2025-68746

Vulnerability

Overview

In the Linux kernel's spi-tegra210-quad driver, a race condition exists between the transfer timeout and the interrupt handler. When the CPU handling the QSPI interrupt (typically CPU 0) is excessively busy, the interrupt handler may not run before the transfer timeout is reached. The timeout cleanup marks the pending message as failed and frees associated memory, but the driver's curr_xfer pointer is left pointing to stale memory. This can lead to a use-after-free if the interrupt handler subsequently accesses that pointer.

Exploitation

An attacker would need to trigger a QSPI transfer on a system where the interrupt-handling CPU is heavily loaded, causing the interrupt handler to be delayed past the timeout. No special privileges are required beyond-normal privileges are required; the vulnerability can be triggered by legitimate SPI operations under high system load. The race window is narrow, making exploitation difficult but not impossible.

Impact

If the race is successfully triggered, the interrupt handler may dereference a freed curr_xfer pointer, leading to memory corruption or a kernel crash (denial of service). In theory, this could be leveraged for privilege escalation, but the description does not provide evidence of such exploitation.

Mitigation

The fix, applied to multiple stable kernel branches including 5.10, 5.15, 6.1, and 6.6 stable trees [1][2][3][4], clears curr_xfer to NULL upon timeout and adds a check in the interrupt handler to abort if curr_xfer is NULL. It also ensures interrupts are cleared on failure. Users should update to the latest stable kernels or backport the patches.