CVE-2026-99164

Status: UPDATED  |  Advisory ID: CVE-2026-99164

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

spi: imx: fix slab corruption from undersized DMA bounce buffers

Since commit faa8e404ad8e ("spi: imx: support dynamic burst length for

ECSPI DMA mode"), the driver allocates its private DMA TX/RX buffers

with kzalloc(dma_len), where dma_len is only rounded up to 4 bytes, but

maps, syncs and unmaps them with DMA_CACHE_ALIGNED_LEN(dma_len), i.e.

rounded up to the cache line size. As a result, the DMA API operates on

memory beyond the end of the allocation.

This was observed on a custom i.MX8MP platform with an mcp251xfd CAN

controller under heavy RPMSG load, as a series of refcount_t warnings

triggered from rpmsg_recv_done() in virtio_rpmsg_bus:

refcount_t: addition on 0; use-after-free.

refcount_t: underflow; use-after-free.

refcount_t: saturated; leaking memory.

Leading finally to an "Unable to handle kernel paging request" oops.

Reproducing this problem took between 30 minutes and roughly 30 hours

under the same workload.

Hardware watchpoints on the refcount of a struct rpmsg_endpoint showed

it was overwritten from 2 to 1 by __pi_memcpy_generic() in the

irq/155-spi2.0 thread. Additionally it was found that a "normal"

rpmsg_recv_done() took 11µs +/-2µs from its kref_get to kref_put. In

the error case the same sequence took about 215µs +/-10µs. Based on

this, an LLM was used to identify the size mismatch fixed here.

Allocate the buffers with DMA_CACHE_ALIGNED_LEN(dma_len) so they cover

the full mapped length, and use the same length for

dma_sync_single_for_cpu() to stay consistent with map and unmap.

With this patch applied, the same workload ran for more than 200 hours

without the problem reproducing. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References