CVE-2024-26807

What it actually does

Incorrect dev_get_drvdata calls in cadence-quadspi runtime_suspend/resume assign the wrong structure pointer, causing spi_controller_resume to receive a cqspi_st pointer and resulting in memory corruption or kernel crashes during PM runtime resume in probe.

Why it matters to the business

Platforms using the cadence-quadspi driver on affected kernels may experience boot-time or device-initialization crashes and instability, leading to downtime on embedded or server systems that rely on the hardware.

How an attack unfolds

An attacker or automated process that causes the cadence-quadspi driver to be probed (for example via hardware presence or module load) triggers PM runtime resume, which dereferences a corrupted pointer and can corrupt kernel memory or panic; threat actor references to Android kernel RCE campaigns indicate potential interest in similar memory corruption primitives.

How to fix it

Upgrade to a fixed kernel version such as 6.1.140 or apply commit 2c914aac9522f6e93822c18dff233d3e92399c81; rebuild and deploy the kernel on all affected systems that use the cadence-quadspi driver.

How to confirm the fix worked

Confirm the running kernel contains the fix commit or is at least version 6.1.140; test that loading the driver no longer produces crashes during probe with PM runtime enabled.

Typical attack path

1. Gain ability to load or trigger probe of cadence-quadspi driver on target kernel
2. Device probe enables PM runtime, invoking runtime_resume hook
3. runtime_resume performs incorrect dev_get_drvdata and passes wrong pointer to spi_controller_resume
4. Resulting memory corruption or crash occurs depending on kernel memory layout

How to detect it

Search kernel logs and dmesg for oops/panic traces referencing cadence-quadspi, cqspi_st, or spi_controller_resume immediately after driver probe; correlate with hardware enumeration events on affected platforms.

What your security team should do

• Prioritize kernel upgrade on all systems exposing cadence-quadspi hardware within the CISA or vendor remediation window
• Monitor for kernel oops or panic logs containing cadence-quadspi or spi_controller_resume symbols
• Restrict driver loading via kernel command-line or module blacklist until patches are applied