CVE-2026-64303: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

spi: fsl-lpspi: terminate the RX channel on TX prepare failure path

When dmaengine_prep_slave_sg() fails for the TX channel, the error path
terminates the TX DMA channel but leaves the RX channel running. Since
the RX channel was already submitted and issued prior to preparing
the TX descriptor, returning -EINVAL causes the SPI core to unmap the
DMA buffers while the RX DMA engine continues writing to them, leading
to potential memory corruption or use-after-free.

Terminate the RX channel before returning on the TX prepare failure path.

The Linux kernel CVE team has assigned CVE-2026-64303 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.2 with commit 09c04466ce7ea494993c0635ba5edb6d2222a806 and fixed in 5.10.261 with commit ad370d1c7a9a832f77b2341513cd31188c9443af
	Issue introduced in 5.2 with commit 09c04466ce7ea494993c0635ba5edb6d2222a806 and fixed in 5.15.212 with commit cce2063404b2341e7b2bbf85eddfcd70a31a0033
	Issue introduced in 5.2 with commit 09c04466ce7ea494993c0635ba5edb6d2222a806 and fixed in 6.1.178 with commit af39a2698f69b584d14a00cffe0f51a2caa15337
	Issue introduced in 5.2 with commit 09c04466ce7ea494993c0635ba5edb6d2222a806 and fixed in 6.6.145 with commit e65505d91fa036a238968e4c10744244d1b968c4
	Issue introduced in 5.2 with commit 09c04466ce7ea494993c0635ba5edb6d2222a806 and fixed in 6.12.96 with commit d5c1060218a3749c8a18b36f8169d910fce20639
	Issue introduced in 5.2 with commit 09c04466ce7ea494993c0635ba5edb6d2222a806 and fixed in 6.18.39 with commit 808033d80d5c9f8adf7e8de9317389270ce13430
	Issue introduced in 5.2 with commit 09c04466ce7ea494993c0635ba5edb6d2222a806 and fixed in 7.1.4 with commit 9d000bdd250d649a11cd7f733175686877344582
	Issue introduced in 5.2 with commit 09c04466ce7ea494993c0635ba5edb6d2222a806 and fixed in 7.2-rc1 with commit 01980b5da56e573d62798d0ff6c86bcaa2b22cbe

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64303
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/spi/spi-fsl-lpspi.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/ad370d1c7a9a832f77b2341513cd31188c9443af
	https://git.kernel.org/stable/c/cce2063404b2341e7b2bbf85eddfcd70a31a0033
	https://git.kernel.org/stable/c/af39a2698f69b584d14a00cffe0f51a2caa15337
	https://git.kernel.org/stable/c/e65505d91fa036a238968e4c10744244d1b968c4
	https://git.kernel.org/stable/c/d5c1060218a3749c8a18b36f8169d910fce20639
	https://git.kernel.org/stable/c/808033d80d5c9f8adf7e8de9317389270ce13430
	https://git.kernel.org/stable/c/9d000bdd250d649a11cd7f733175686877344582
	https://git.kernel.org/stable/c/01980b5da56e573d62798d0ff6c86bcaa2b22cbe