CVE-2026-31560

Vulnerability

In the Linux kernel's spi-dw-dma driver, an error condition during a transaction could cause a NULL pointer dereference. When an error occurs, the device may not have a current message, and the code attempted to access it, leading to a system crash.

Exploitation

An attacker who can trigger an error during an SPI transaction could exploit this vulnerability. No special privileges are required beyond the ability to interact with the SPI subsystem, but the attacker must be able to cause the device to be in an error state without a current message.

Impact

Successful exploitation results in a kernel panic, causing a denial of service (system crash).

Mitigation

The fix is included in stable kernel updates [1] and [2]. Users should apply the latest patches from their distribution or the mainline kernel.