CVE-2026-64169

What it actually does

Error pointer dereference in the ep93xx SPI driver when DMA channel setup fails during probe, allowing fallback to PIO mode without clearing pointers and leading to dereference on subsequent probe failures or driver unbind.

Why it matters to the business

System crashes or denial of service on Linux kernels using ep93xx SPI hardware, potentially disrupting operations on embedded or affected devices with low likelihood of remote exploitation.

How an attack unfolds

An attacker with local access triggers repeated driver probe or unbind operations after an initial DMA setup failure to force dereference of an error pointer, causing kernel instability.

How to fix it

Apply the upstream fix that clears DMA channel pointers on setup failure; update to a kernel containing the resolution for the ep93xx driver.

How to confirm the fix worked

Confirm the patch is present by inspecting the ep93xx driver source for pointer clearing logic after DMA setup failure; test probe and unbind paths on affected hardware.

Typical attack path

1. Obtain local access to the system
2. Trigger SPI driver probe with DMA setup failure
3. Force subsequent probe error or unbind
4. Trigger kernel dereference leading to panic

How to detect it

Review kernel logs for ep93xx driver probe failures followed by oops or panic traces involving DMA pointers; no widespread exploitation indicators expected given low EPSS and no KEV status.

What your security team should do

• Prioritize kernel updates for systems using ep93xx SPI hardware
• Monitor for local privilege escalation attempts targeting kernel drivers
• Test driver behavior under DMA failure conditions in lab environments