{"id":"CVE-2024-26807","state":"PUBLISHED","title":"spi: cadence-qspi: fix pointer reference in runtime PM hooks","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBoth cadence-quadspi ->runtime_suspend() and ->runtime_resume()\nimplementations start with:\n\n\tstruct cqspi_st *cqspi = dev_get_drvdata(dev);\n\tstruct spi_controller *host = dev_get_drvdata(dev);\n\nThis obviously cannot be correct, unless \"struct cqspi_st\" is the\nfirst member of \" struct spi_controller\", or the other way around, but\nit is not the case. \"struct spi_controller\" is allocated by\ndevm_spi_alloc_host(), which allocates an extra amount of memory for\nprivate data, used to store \"struct cqspi_st\".\n\nThe ->probe() function of the cadence-quadspi driver then sets the\ndevice drvdata to store the address of the \"struct cqspi_st\"\nstructure. Therefore:\n\n\tstruct cqspi_st *cqspi = dev_get_drvdata(dev);\n\nis correct, but:\n\n\tstruct spi_controller *host = dev_get_drvdata(dev);\n\nis not, as it makes \"host\" point not to a \"struct spi_controller\" but\nto the same \"struct cqspi_st\" structure as above.\n\nThis obviously leads to bad things (memory corruption, kernel crashes)\ndirectly during ->probe(), as ->probe() enables the device using PM\nruntime, leading the ->runtime_resume() hook being called, which in\nturns calls spi_controller_resume() with the wrong pointer.\n\nThis has at least been reported [0] to cause a kernel crash, but the\nexact behavior will depend on the memory contents.\n\n[0] https://lore.kernel.org/all/20240226121803.5a7r5wkpbbowcxgx@dhruva/\n\nThis issue potentially affects all platforms that are currently using\nthe cadence-quadspi driver.","publishedAt":"2024-04-04T08:20:34.155Z","updatedAt":"2026-08-05T11:27:25.924Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"79acf7fb856eade9c3d0cf00fd34a04bf5c43a1c","status":"affected","lessThan":"2c914aac9522f6e93822c18dff233d3e92399c81","versionType":"git"},{"version":"2087e85bb66ee3652dafe732bb9b9b896229eafc","status":"affected","lessThan":"03f1573c9587029730ca68503f5062105b122f61","versionType":"git"},{"version":"2087e85bb66ee3652dafe732bb9b9b896229eafc","status":"affected","lessThan":"34e1d5c4407c78de0e3473e1fbf8fb74dbe66d03","versionType":"git"},{"version":"2087e85bb66ee3652dafe732bb9b9b896229eafc","status":"affected","lessThan":"32ce3bb57b6b402de2aec1012511e7ac4e7449dc","versionType":"git"},{"version":"e3f9fc9a4f1499cc9e1bad4482d377494e367b3d","status":"affected","versionType":"git"},{"version":"6716203844bc8489af5e5564f0fa31e0c094a7ff","status":"affected","versionType":"git"},{"version":"b24f1ecc8fe2ceefc14af02edb1744c246d87bf7","status":"affected","versionType":"git"},{"version":"d453f25faf681799d636fe9d6899ad91c45aa11e","status":"affected","versionType":"git"},{"version":"18cb554e9da81bc4eca653c17a0d65e8b5835c09","status":"affected","versionType":"git"},{"version":"1368dbc0a432acf9fc0dcb23bfe52d32ca4c09ab","status":"affected","versionType":"git"},{"version":"6.1.28","status":"affected","lessThan":"6.1.140","versionType":"semver"},{"version":"4.19.283","status":"affected","lessThan":"4.20","versionType":"semver"},{"version":"5.4.243","status":"affected","lessThan":"5.5","versionType":"semver"},{"version":"5.10.180","status":"affected","lessThan":"5.11","versionType":"semver"},{"version":"5.15.111","status":"affected","lessThan":"5.16","versionType":"semver"},{"version":"6.2.15","status":"affected","lessThan":"6.3","versionType":"semver"},{"version":"6.3.2","status":"affected","lessThan":"6.4","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/spi/spi-cadence-quadspi.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.4","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.4","versionType":"semver"},{"version":"6.1.140","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.21","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.7.9","status":"unaffected","lessThanOrEqual":"6.7.*","versionType":"semver"},{"version":"6.8","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/spi/spi-cadence-quadspi.c"]}],"references":["https://git.kernel.org/stable/c/2c914aac9522f6e93822c18dff233d3e92399c81","https://git.kernel.org/stable/c/03f1573c9587029730ca68503f5062105b122f61","https://git.kernel.org/stable/c/34e1d5c4407c78de0e3473e1fbf8fb74dbe66d03","https://git.kernel.org/stable/c/32ce3bb57b6b402de2aec1012511e7ac4e7449dc","https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:07:10.607Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/26xxx/CVE-2024-26807.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-26807","state":"PUBLISHED","datePublished":"2024-04-04T08:20:34.155Z","dateUpdated":"2026-08-05T11:27:25.924Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-02-19T14:20:24.179Z"},"containers":{"cna":{"title":"spi: cadence-qspi: fix pointer reference in runtime PM hooks","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBoth cadence-quadspi ->runtime_suspend() and ->runtime_resume()\nimplementations start with:\n\n\tstruct cqspi_st *cqspi = dev_get_drvdata(dev);\n\tstruct spi_controller *host = dev_get_drvdata(dev);\n\nThis obviously cannot be correct, unless \"struct cqspi_st\" is the\nfirst member of \" struct spi_controller\", or the other way around, but\nit is not the case. \"struct spi_controller\" is allocated by\ndevm_spi_alloc_host(), which allocates an extra amount of memory for\nprivate data, used to store \"struct cqspi_st\".\n\nThe ->probe() function of the cadence-quadspi driver then sets the\ndevice drvdata to store the address of the \"struct cqspi_st\"\nstructure. Therefore:\n\n\tstruct cqspi_st *cqspi = dev_get_drvdata(dev);\n\nis correct, but:\n\n\tstruct spi_controller *host = dev_get_drvdata(dev);\n\nis not, as it makes \"host\" point not to a \"struct spi_controller\" but\nto the same \"struct cqspi_st\" structure as above.\n\nThis obviously leads to bad things (memory corruption, kernel crashes)\ndirectly during ->probe(), as ->probe() enables the device using PM\nruntime, leading the ->runtime_resume() hook being called, which in\nturns calls spi_controller_resume() with the wrong pointer.\n\nThis has at least been reported [0] to cause a kernel crash, but the\nexact behavior will depend on the memory contents.\n\n[0] https://lore.kernel.org/all/20240226121803.5a7r5wkpbbowcxgx@dhruva/\n\nThis issue potentially affects all platforms that are currently using\nthe cadence-quadspi driver."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"79acf7fb856eade9c3d0cf00fd34a04bf5c43a1c","status":"affected","lessThan":"2c914aac9522f6e93822c18dff233d3e92399c81","versionType":"git"},{"version":"2087e85bb66ee3652dafe732bb9b9b896229eafc","status":"affected","lessThan":"03f1573c9587029730ca68503f5062105b122f61","versionType":"git"},{"version":"2087e85bb66ee3652dafe732bb9b9b896229eafc","status":"affected","lessThan":"34e1d5c4407c78de0e3473e1fbf8fb74dbe66d03","versionType":"git"},{"version":"2087e85bb66ee3652dafe732bb9b9b896229eafc","status":"affected","lessThan":"32ce3bb57b6b402de2aec1012511e7ac4e7449dc","versionType":"git"},{"version":"e3f9fc9a4f1499cc9e1bad4482d377494e367b3d","status":"affected","versionType":"git"},{"version":"6716203844bc8489af5e5564f0fa31e0c094a7ff","status":"affected","versionType":"git"},{"version":"b24f1ecc8fe2ceefc14af02edb1744c246d87bf7","status":"affected","versionType":"git"},{"version":"d453f25faf681799d636fe9d6899ad91c45aa11e","status":"affected","versionType":"git"},{"version":"18cb554e9da81bc4eca653c17a0d65e8b5835c09","status":"affected","versionType":"git"},{"version":"1368dbc0a432acf9fc0dcb23bfe52d32ca4c09ab","status":"affected","versionType":"git"},{"version":"6.1.28","status":"affected","lessThan":"6.1.140","versionType":"semver"},{"version":"4.19.283","status":"affected","lessThan":"4.20","versionType":"semver"},{"version":"5.4.243","status":"affected","lessThan":"5.5","versionType":"semver"},{"version":"5.10.180","status":"affected","lessThan":"5.11","versionType":"semver"},{"version":"5.15.111","status":"affected","lessThan":"5.16","versionType":"semver"},{"version":"6.2.15","status":"affected","lessThan":"6.3","versionType":"semver"},{"version":"6.3.2","status":"affected","lessThan":"6.4","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/spi/spi-cadence-quadspi.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.4","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.4","versionType":"semver"},{"version":"6.1.140","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.21","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.7.9","status":"unaffected","lessThanOrEqual":"6.7.*","versionType":"semver"},{"version":"6.8","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/spi/spi-cadence-quadspi.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/2c914aac9522f6e93822c18dff233d3e92399c81"},{"url":"https://git.kernel.org/stable/c/03f1573c9587029730ca68503f5062105b122f61"},{"url":"https://git.kernel.org/stable/c/34e1d5c4407c78de0e3473e1fbf8fb74dbe66d03"},{"url":"https://git.kernel.org/stable/c/32ce3bb57b6b402de2aec1012511e7ac4e7449dc"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is the runtime-PM hook of an on-SoC Cadence QSPI controller driver, reached through local flash I/O (MTD/mtdblock access driving `cqspi_exec_mem_op()` → `pm_runtime_resume_and_get()`) or the autosuspend timer. There is no network or remote-peer input path into this driver.\nAC:L - The wrong pointer is passed unconditionally on every suspend and resume, so the corrupting code path executes deterministically at probe time and on each runtime-PM transition; no race, timing window, or uncontrolled precondition needs to be won.\nPR:L - Any unprivileged local process can drive the cycle by touching a file on the flash-backed filesystem and then idling for the 2-second autosuspend timeout; no capability, CAP_SYS_ADMIN, or device-node ownership check exists anywhere along `cqspi_exec_mem_op()` → runtime PM → `cqspi_suspend()/cqspi_resume()`.\nUI:N - Autosuspend/resume transitions occur automatically from normal device activity and the 2 s idle timer, and the corruption already happens during probe; no victim action of any kind is required.\nS:U - The corruption is confined to kernel slab memory and the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a type confusion in which `struct cqspi_st` is treated as `struct spi_controller`, causing reads and writes at offsets (`bus_lock_mutex` ~930B, `queued`, `kworker`) that fall into `f_pdata` or past the end of the `devm_spi_alloc_host()` allocation; such heap corruption with a groomable adjacent object can be leveraged into an arbitrary-read primitive.\nI:H - Type confusion with out-of-bounds writes — `ctlr->flags |=`, the mutex owner word, and `list_add_tail()` on an uninitialised `wait_list` in the mutex slowpath — plus `kthread_queue_work()` on a garbage `ctlr->kworker` pointer, gives write and control-flow corruption primitives rather than a benign fault.\nA:H - The upstream fix and the linked bug report document kernel crashes and memory corruption during probe; `mutex_lock()` on uninitialised memory can also hang the task indefinitely, and the path can be re-triggered repeatedly by an unprivileged user."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:27:25.924Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.28","versionEndExcluding":"6.1.140"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4","versionEndExcluding":"6.6.21"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4","versionEndExcluding":"6.7.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4","versionEndExcluding":"6.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19.283"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.243"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.180"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.111"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2.15"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/03f1573c9587029730ca68503f5062105b122f61","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/34e1d5c4407c78de0e3473e1fbf8fb74dbe66d03","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/32ce3bb57b6b402de2aec1012511e7ac4e7449dc","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T19:29:35.945Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-26807","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-10T15:50:43.187812Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-11T17:33:46.008Z"}}]}}}