CVE-2024-26807

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: The issue is related to the cadence-quadspi driver in the Linux kernel. The ->runtime suspend() and ->runtime resume() implementations start with incorrect assignments, leading to memory corruption and kernel crashes. The struct spi controller *host = dev get drvdata(dev); line is incorrect, as it makes the host point to the same struct cqspi st structure as cqspi, instead of a struct spi controller. This leads to bad things, such as memory corruption and kernel crashes, directly during the ->probe() function, as it enables the device using PM runtime, leading to the ->runtime resume() hook being called, which in turn calls spi controller resume() with the wrong pointer.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.