{"id":"CVE-2026-64221","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: ti-qspi: fix use-after-free after DMA setup failure\n\nThe driver falls back to PIO mode if DMA setup fails during probe.\n\nMake sure to clear the DMA channel pointer…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: ti-qspi: fix use-after-free after DMA setup failure\n\nThe driver falls back to PIO mode if DMA setup fails during probe.\n\nMake sure to clear the DMA channel pointer…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","published":"2026-07-24","updated":"2026-07-27","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-64221","references":[{"url":"https://git.kernel.org/stable/c/178b9b570c0f75fa7e691490520328b20d19138e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1cd927002120678bd5d23c760246639caa53040e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3bbbe7ae3fdada0df4157c1ffe989f92dfa8dcd6","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9c6f306a8140962c7284197db54b96fdb5f468d6","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d6f422b122922d1abee907d673bcc990e5f3672d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d7a076fb596c7b408ed6df74793a597990a6d860","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ea6ec3343e05f7937a53eb6d7617b3abdb4abc19","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f2dc841d7dc9063fe9b47ced869b1271e55052ae","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd"],"epss":0.00126,"epssPercentile":0.02642,"ingestedAt":"2026-07-27T06:16:49.162Z","slug":"CVE-2026-64221","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nspi: ti-qspi: fix use-after-free after DMA setup failure\n\nThe driver falls back to PIO mode if DMA setup fails during probe.\n\nMake sure to clear the DMA channel pointer also if buffer allocation\nfails to avoid passing a pointer to the released channel to the DMA\nengine (or trying to free the channel a second time on late probe errors\nor driver unbind).\n\nThis issue was flagged by Sashiko when reviewing a devres allocation\nconversion patch.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}