19 matches found
SUSE CVE-2026-99164
In the Linux kernel, the following vulnerability has been resolved: spi: imx: fix slab corruption from undersized DMA bounce buffers Since commit faa8e404ad8e "spi: imx: support dynamic burst length for ECSPI DMA mode", the driver allocates its private DMA TX/RX buffers with kzallocdmalen, where...
CVE-2026-99164
A flaw was found in the Linux kernel's Serial Peripheral Interface SPI driver for i.MX devices. The driver allocates Direct Memory Access DMA bounce buffers that are smaller than the cache line size used during hardware mapping and synchronization. This size discrepancy causes DMA operations to...
CVE-2026-99164
In the Linux kernel, the following vulnerability has been resolved: spi: imx: fix slab corruption from undersized DMA bounce buffers Since commit faa8e404ad8e "spi: imx: support dynamic burst length for ECSPI DMA mode", the driver allocates its private DMA TX/RX buffers with kzallocdmalen, where...
DEBIAN-CVE-2026-99164
In the Linux kernel, the following vulnerability has been resolved: spi: imx: fix slab corruption from undersized DMA bounce buffers Since commit faa8e404ad8e "spi: imx: support dynamic burst length for ECSPI DMA mode", the driver allocates its private DMA TX/RX buffers with kzallocdmalen, where...
CVE-2026-99164
In the Linux kernel, the following vulnerability has been resolved: spi: imx: fix slab corruption from undersized DMA bounce buffers Since commit faa8e404ad8e "spi: imx: support dynamic burst length for ECSPI DMA mode", the driver allocates its private DMA TX/RX buffers with kzallocdmalen, where...
EUVD-2026-111916
In the Linux kernel, the following vulnerability has been resolved: spi: imx: fix slab corruption from undersized DMA bounce buffers Since commit faa8e404ad8e "spi: imx: support dynamic burst length for ECSPI DMA mode", the driver allocates its private DMA TX/RX buffers with kzallocdmalen, where...
CVE-2026-99164 spi: imx: fix slab corruption from undersized DMA bounce buffers
In the Linux kernel, the following vulnerability has been resolved: spi: imx: fix slab corruption from undersized DMA bounce buffers Since commit faa8e404ad8e "spi: imx: support dynamic burst length for ECSPI DMA mode", the driver allocates its private DMA TX/RX buffers with kzallocdmalen, where...
CVE-2026-99164 spi: imx: fix slab corruption from undersized DMA bounce buffers
In the Linux kernel, the following vulnerability has been resolved: spi: imx: fix slab corruption from undersized DMA bounce buffers Since commit faa8e404ad8e "spi: imx: support dynamic burst length for ECSPI DMA mode", the driver allocates its private DMA TX/RX buffers with kzallocdmalen, where...
CVE-2026-99164
The Linux kernel contains a vulnerability in the spi: imx driver where private DMA TX/RX buffers are allocated with kzalloc(dma_len), rounding dma_len only to 4 bytes. However, the driver maps, syncs, and unmaps these buffers using DMA_CACHE_ALIGNED_LEN(dma_len), which rounds to the cache line si...
Linux Distros Unpatched Vulnerability : CVE-2026-99164
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - spi: imx: fix slab corruption from undersized DMA bounce buffers Since commit faa8e404ad8e spi: imx: support dynamic burst length for ECSPI DMA mode, the driver...
CVE-2026-99164
In the Linux kernel, the following vulnerability has been resolved: spi: imx: fix slab corruption from undersized DMA bounce buffers Since commit faa8e404ad8e "spi: imx: support dynamic burst length for ECSPI DMA mode", the driver allocates its private DMA TX/RX buffers with kzallocdmalen, where...
CVE-2026-99164: Linux: In the Linux kernel, the following vulnerability has been resolved: spi: imx: fix slab corruption from undersized DMA…
In the Linux kernel, the following vulnerability has been resolved: spi: imx: fix slab corruption from undersized DMA bounce buffers Since commit faa8e404ad8e "spi: imx: support dynamic burst length for ECSPI DMA mode", the driver allocates its private DMA TX/RX buffers with kzallocdmalen, where...
UBUNTU-CVE-2026-99164
In the Linux kernel, the following vulnerability has been resolved: spi: imx: fix slab corruption from undersized DMA bounce buffers Since commit faa8e404ad8e "spi: imx: support dynamic burst length for ECSPI DMA mode", the driver allocates its private DMA TX/RX buffers with kzallocdmalen, where...
CVE-2026-98254
A flaw was found in the Linux kernel's Software I/O Translation Lookaside Buffer swiotlb. During Direct Memory Access DMA bounce operations involving high memory, an incorrect address calculation occurs when an offset crosses a page boundary. This error causes data transfers to read from or...
CVE-2026-11743
The SF32LB MPI QSPI NOR flash driver drivers/flash/flashsf32lbmpiqspinor.c validated the flash offset and length on its read and write paths with the test offset + size data-size. Because offset is a signed offt while size is unsigned, a negative offset is converted to a large unsigned value and...
CVE-2026-11743 Missing negative-offset/overflow check in SF32LB MPI QSPI NOR flash driver allows out-of-bounds read and write
The SF32LB MPI QSPI NOR flash driver drivers/flash/flashsf32lbmpiqspinor.c validated the flash offset and length on its read and write paths with the test offset + size data-size. Because offset is a signed offt while size is unsigned, a negative offset is converted to a large unsigned value and...
EUVD-2026-54682
The SF32LB MPI QSPI NOR flash driver drivers/flash/flashsf32lbmpiqspinor.c validated the flash offset and length on its read and write paths with the test offset + size data-size. Because offset is a signed offt while size is unsigned, a negative offset is converted to a large unsigned value and...
CVE-2026-11743
The CVE concerns the SF32LB MPI QSPI NOR flash driver (drivers/flash/flash_sf32lb_mpi_qspi_nor.c). The vulnerability arises in the read/write paths where a signed offset (off_t) is compared against an unsigned size using (offset + size) > data->size, allowing a negative offset to wrap to a ...
CVE-2026-11743 Missing negative-offset/overflow check in SF32LB MPI QSPI NOR flash driver allows out-of-bounds read and write
The SF32LB MPI QSPI NOR flash driver drivers/flash/flashsf32lbmpiqspinor.c validated the flash offset and length on its read and write paths with the test offset + size data-size. Because offset is a signed offt while size is unsigned, a negative offset is converted to a large unsigned value and...