Linux Kernel i.MX SPI driver: Slab memory corruption in DMA buffers
Summary
The i.MX SPI driver (spi: imx) in the Linux kernel allocates its private DMA TX/RX buffers smaller than the length it maps, syncs and unmaps. The DMA API therefore accesses memory beyond the end of each allocation, which can corrupt kernel slab memory. The reporter observed refcount warnings, a use-after-free pattern and a kernel oops under heavy RPMSG load on an i.MX8MP board with an SPI-attached CAN controller. The CVE record does not describe a remote attack path; exploitation would require local access with low privileges.
Affected
- Linux kernel from commit faa8e404ad8e up to, but not including, the fixing commits (CVE record)
- Linux kernel 7.0.0 up to, but not including, 7.2.13 (OSV)
- Third-party data conflicts on the exact range (VulDB: up to 7.2.12; OffSeq: 7.0.0 to 7.3.0)
Fixed in
- Stable commits 2777f6637da02da84c9c1ff92f413ce0f0995084 and 59eb22641f0c526dd064390b11cff99ae87c2858
- Linux kernel 7.2.13 (OSV)
- Distribution and BSP fix versions: Unknown.
Workaround
Unknown. No workaround is documented in the sources. Apply a kernel that contains the fix.
Exploitation
- OffSeq: not known to be exploited
- No public proof of concept found
- EPSS: 0.16 % (percentile 5)
- Exploitation in the wild: nothing known
Our recommendation
- Identify i.MX-based devices (gateways, HMIs, industrial controllers) that use SPI peripherals with DMA.
- Ask device and BSP vendors whether their kernels include the stable fix and request an update.
- Apply the fixed kernel as soon as it is available for your distribution or device.
- Monitor vendor advisories, as Ubuntu and Debian had not yet published fixes at the time of research.
- Office servers and workstations are generally not affected.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux stable commit 2777f6637da02da84c9c1ff92f413ce0f0995084 git.kernel.org
- Linux stable commit 59eb22641f0c526dd064390b11cff99ae87c2858 git.kernel.org
- Ubuntu security notice CVE-2026-99164 ubuntu.com
- Vulners Debian CVE entry CVE-2026-99164 vulners.com
- VulDB entry 427841 vuldb.com
- Strix CVE entry CVE-2026-99164 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:01.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: spi: imx: fix slab corruption from undersized DMA bounce buffers Since commit faa8e404ad8e ("spi: imx: support dynamic burst length for ECSPI DMA mode"), the driver allocates its private DMA TX/RX buffers with kzalloc(dma_len), where dma_len is only rounded up to 4 bytes, but maps, syncs and unmaps them with DMA_CACHE_ALIGNED_LEN(dma_len), i.e. rounded up to the cache line size. As a result, the DMA API operates on memory beyond the end of the allocation. This was observed on a custom i.MX8MP platform with an mcp251xfd CAN controller under heavy RPMSG load, as a series of refcount_t warnings triggered from rpmsg_recv_done() in virtio_rpmsg_bus: refcount_t: addition on 0; use-after-free. refcount_t: underflow; use-after-free. refcount_t: saturated; leaking memory. Leading finally to an "Unable to handle kernel paging request" oops. Reproducing this problem took between 30 minutes and roughly 30 hours under the same workload. Hardware watchpoints on the refcount of a struct rpmsg_endpoint showed it was overwritten from 2 to 1 by __pi_memcpy_generic() in the irq/155-spi2.0 thread. Additionally it was found that a "normal" rpmsg_recv_done() took 11µs +/-2µs from its kref_get to kref_put. In the error case the same sequence took about 215µs +/-10µs. Based on this, an LLM was used to identify the size mismatch fixed here. Allocate the buffers with DMA_CACHE_ALIGNED_LEN(dma_len) so they cover the full mapped length, and use the same length for dma_sync_single_for_cpu() to stay consistent with map and unmap. With this patch applied, the same workload ran for more than 200 hours without the problem reproducing.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.