CVE-2023-52749

What it actually does

A race condition in the Linux kernel SPI subsystem allows a synchronous noqueue transfer to remain active during system suspend, causing spi_controller_resume to reset cur_msg to NULL; the resuming transfer context then dereferences the NULL pointer in spi_finalize_current_message.

Why it matters to the business

Systems using affected older Ubuntu kernels may experience crashes or instability during suspend/resume cycles, resulting in denial of service; prevalence is limited to long-EOL releases with fixes available for years.

How an attack unfolds

An attacker with local privileges initiates a synchronous SPI transfer, forces a system suspend that interrupts the transfer, then allows resume; the kernel resets the message pointer and the finalization path crashes. No widespread threat-actor campaigns are associated.

How to fix it

Upgrade affected packages to the listed fixed versions: linux 3.13.0-83.127 (Ubuntu 14.04), linux-aws 4.4.0-1002.2 (Ubuntu 14.04), linux 4.4.0-4.19 (Ubuntu 16.04), linux-hwe 4.8.0-36.36~16.04.1 (Ubuntu 16.04), and equivalent fixes for all other listed variants; enable the bus mutex and suspend flag as described in the fix.

How to confirm the fix worked

Verify running kernel matches or exceeds a fixed version for the distribution; exercise suspend/resume paths while performing synchronous SPI transfers and confirm absence of NULL dereference oops in dmesg.

Typical attack path

1. Obtain local user access on an affected Linux system
2. Trigger or wait for a synchronous SPI transfer via spi_sync
3. Force system suspend while the transfer context is active
4. Allow system resume to execute spi_controller_resume and spi_start_queue
5. Trigger the NULL dereference in spi_finalize_current_message

How to detect it

Search kernel logs for oops or panic messages containing spi_finalize_current_message, cur_msg NULL dereference, or stack traces involving spi_controller_resume around suspend/resume events.

What your security team should do

• Apply the listed kernel updates on all remaining affected systems immediately
• Disable unnecessary SPI devices or synchronous transfers if updates cannot be applied
• Add kernel oops monitoring for SPI-related NULL dereferences during power events
• Review and deprecate any remaining Ubuntu 14.04/16.04 LTS deployments