CVE-2026-99164

In the Linux kernel, the following vulnerability has been resolved:

spi: imx: fix slab corruption from undersized DMA bounce buffers

Since commit faa8e404ad8e ("spi: imx: support dynamic burst length for ECSPI DMA mode"), the driver allocates its private DMA TX/RX buffers with kzalloc(dma len), where dma len is only rounded up to 4 bytes, but maps, syncs and unmaps them with DMA CACHE ALIGNED LEN(dma len), i.e. rounded up to the cache line size. As a result, the DMA API operates on memory beyond the end of the allocation.

This was observed on a custom i.MX8MP platform with an mcp251xfd CAN controller under heavy RPMSG load, as a series of refcount t warnings triggered from rpmsg recv done() in virtio rpmsg bus:

refcount t: addition on 0; use-after-free. refcount t: underflow; use-after-free. refcount t: saturated; leaking memory.

Leading finally to an "Unable to handle kernel paging request" oops. Reproducing this problem took between 30 minutes and roughly 30 hours under the same workload.

Hardware watchpoints on the refcount of a struct rpmsg endpoint showed it was overwritten from 2 to 1 by pi memcpy generic() in the irq/155-spi2.0 thread. Additionally it was found that a "normal" rpmsg recv done() took 11µs +/-2µs from its kref get to kref put. In the error case the same sequence took about 215µs +/-10µs. Based on this, an LLM was used to identify the size mismatch fixed here.

Allocate the buffers with DMA CACHE ALIGNED LEN(dma len) so they cover the full mapped length, and use the same length for dma sync single for cpu() to stay consistent with map and unmap.

With this patch applied, the same workload ran for more than 200 hours without the problem reproducing.