CVE-2026-64303
A bug in the Linux kernel’s fsl‑lpspi SPI driver caused the receive (RX) channel to keep running after a transmit (TX) preparation failure, leading to memory corruption or use‑after‑free. The issue has been fixed in the kernel. Users should update to a kernel version that includes the patch.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel, specifically the fsl‑lpspi SPI driver used in many embedded devices. System administrators and developers maintaining Linux‑based systems are the typical users.
Real-world impact
An attacker could trigger memory corruption or a use‑after‑free, potentially allowing arbitrary code execution or causing the system to crash.
Why this severity
The CVSS score of 9.8 reflects that the flaw requires no authentication, no user interaction, and has full confidentiality, integrity, and availability impact, with low attack complexity.
What to do about it
- 01Upgrade your Linux kernel to a version that includes the fix.
NVD description
Timeline
- Jul 25, 2026 · 7d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 27, 2026 · 5d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/01980b5da56e573d62…
- git.kernel.org/stable/c/808033d80d5c9f8adf…
- git.kernel.org/stable/c/9d000bdd250d649a11…
- git.kernel.org/stable/c/ad370d1c7a9a832f77…
- git.kernel.org/stable/c/af39a2698f69b584d1…
- git.kernel.org/stable/c/cce2063404b2341e7b…
- git.kernel.org/stable/c/d5c1060218a3749c8a…
- git.kernel.org/stable/c/e65505d91fa036a238…