CVE ID : CVE-2026-23207<\/p>\n
Published : Feb. 14, 2026, 5:15 p.m. | 1\u00a0hour, 14\u00a0minutes ago<\/p>\n
Description : In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
spi: tegra210-quad: Protect curr_xfer check in IRQ handler<\/p>\n
Now that all other accesses to curr_xfer are done under the lock,
\nprotect the curr_xfer NULL check in tegra_qspi_isr_thread() with the
\nspinlock. Without this protection, the following race can occur:<\/p>\n
CPU0 (ISR thread) CPU1 (timeout path)
\n —————- ——————-
\n if (!tqspi->curr_xfer)
\n \/\/ sees non-NULL
\n spin_lock()
\n tqspi->curr_xfer = NULL
\n spin_unlock()
\n handle_*_xfer()
\n spin_lock()
\n t = tqspi->curr_xfer \/\/ NULL!
\n … t->len … \/\/ NULL dereference!<\/p>\n
With this patch, all curr_xfer accesses are now properly synchronized.<\/p>\n
Although all accesses to curr_xfer are done under the lock, in
\ntegra_qspi_isr_thread() it checks for NULL, releases the lock and
\nreacquires it later in handle_cpu_based_xfer()\/handle_dma_based_xfer().
\nThere is a potential for an update in between, which could cause a NULL
\npointer dereference.<\/p>\n
To handle this, add a NULL check inside the handlers after acquiring
\nthe lock. This ensures that if the timeout path has already cleared
\ncurr_xfer, the handler will safely return without dereferencing the
\nNULL pointer.<\/p>\n
Severity: 0.0 | NA<\/p>\n
Visit the link for more details, such as CVSS details, affected products, timeline, and more…\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"
CVE ID : CVE-2026-23207 Published : Feb. 14, 2026, 5:15 p.m. | 1\u00a0hour, 14\u00a0minutes ago Description : In the Linux kernel, the following vulnerability has been resolved: spi: tegra210-quad: Protect curr_xfer check in IRQ handler Now that all other accesses to curr_xfer are done under the lock, protect the curr_xfer NULL check in tegra_qspi_isr_thread() with …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-77157","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/77157","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=77157"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/77157\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=77157"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=77157"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=77157"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}