{"api_version":"1","generated_at":"2026-08-22T06:20:45+00:00","cve":"CVE-2026-72134","urls":{"html":"https://cve.report/CVE-2026-72134","api":"https://cve.report/api/cve/CVE-2026-72134.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-72134","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-72134"},"summary":{"title":"spi: imx: reconfigure for PIO when DMA cannot be started","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: imx: reconfigure for PIO when DMA cannot be started\n\nWhen spi_imx_can_dma() selects DMA, the ECSPI is configured for DMA:\nspi_imx_setupxfer() sets CTRL.SMC and clears dynamic_burst, and\nspi_imx_dma_transfer() programs the dynamic-burst BURST_LENGTH and the\nSDMA watermarks.\n\nIf the DMA descriptor cannot be prepared (dmaengine_prep_slave_single()\nreturns NULL), the transfer is failed with SPI_TRANS_FAIL_NO_START and\nfalls back to PIO. The dynamic-burst DMA path uses its own bounce\nbuffers instead of the SPI core's mapping, so xfer->{tx,rx}_sg_mapped\nare not set and the core's DMA->PIO retry is skipped; the driver falls\nback to PIO internally. But none of the DMA-mode configuration is\nundone, so the PIO transfer runs with CTRL.SMC set, the wrong burst\nlength and dynamic_burst cleared, and the transferred data is corrupted.\n\nThis is easily hit on i.MX8MP boards that describe ECSPI DMA in the\ndevice tree but run SDMA on ROM firmware (no external sdma-imx7d.bin):\nevery ECSPI DMA prepare fails. An Infineon SLB9670 TPM on ECSPI1 then\nreturns shifted TPM2_GetCapability data, is flagged \"field failure\nmode\", /dev/tpmrm0 is never created.\n\nSet controller->fallback before re-running spi_imx_setupxfer() so the\nECSPI is reconfigured exactly like a normal PIO transfer. With\ncontroller->fallback set, spi_imx_setupxfer() sees spi_imx_can_dma()\nreturn false, so it clears spi_imx->usedma and reprograms the controller\n(clears CTRL.SMC, restores dynamic_burst and the PIO burst length). No\nexplicit spi_imx->usedma = false is needed: setupxfer() already updates\nit from the can_dma() result.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-15 06:21:30","updated_at":"2026-08-17 06:18:13"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/40dee2d3e9994aed9efe7bed40eb0e4d38d5a25c","name":"https://git.kernel.org/stable/c/40dee2d3e9994aed9efe7bed40eb0e4d38d5a25c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/245404c26563aafb36aafb01298f148db1851be3","name":"https://git.kernel.org/stable/c/245404c26563aafb36aafb01298f148db1851be3","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72134","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72134","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected faa8e404ad8e686cb98c51dc507fdcacfb8020ce 40dee2d3e9994aed9efe7bed40eb0e4d38d5a25c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected faa8e404ad8e686cb98c51dc507fdcacfb8020ce 245404c26563aafb36aafb01298f148db1851be3 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7.0","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.0 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.5 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"72134","cve":"CVE-2026-72134","epss":"0.001650000","percentile":"0.062000000","score_date":"2026-08-17","updated_at":"2026-08-18 00:11:47"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/spi/spi-imx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"40dee2d3e9994aed9efe7bed40eb0e4d38d5a25c","status":"affected","version":"faa8e404ad8e686cb98c51dc507fdcacfb8020ce","versionType":"git"},{"lessThan":"245404c26563aafb36aafb01298f148db1851be3","status":"affected","version":"faa8e404ad8e686cb98c51dc507fdcacfb8020ce","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/spi/spi-imx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"7.0"},{"lessThan":"7.0","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.5","versionStartIncluding":"7.0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: imx: reconfigure for PIO when DMA cannot be started\n\nWhen spi_imx_can_dma() selects DMA, the ECSPI is configured for DMA:\nspi_imx_setupxfer() sets CTRL.SMC and clears dynamic_burst, and\nspi_imx_dma_transfer() programs the dynamic-burst BURST_LENGTH and the\nSDMA watermarks.\n\nIf the DMA descriptor cannot be prepared (dmaengine_prep_slave_single()\nreturns NULL), the transfer is failed with SPI_TRANS_FAIL_NO_START and\nfalls back to PIO. The dynamic-burst DMA path uses its own bounce\nbuffers instead of the SPI core's mapping, so xfer->{tx,rx}_sg_mapped\nare not set and the core's DMA->PIO retry is skipped; the driver falls\nback to PIO internally. But none of the DMA-mode configuration is\nundone, so the PIO transfer runs with CTRL.SMC set, the wrong burst\nlength and dynamic_burst cleared, and the transferred data is corrupted.\n\nThis is easily hit on i.MX8MP boards that describe ECSPI DMA in the\ndevice tree but run SDMA on ROM firmware (no external sdma-imx7d.bin):\nevery ECSPI DMA prepare fails. An Infineon SLB9670 TPM on ECSPI1 then\nreturns shifted TPM2_GetCapability data, is flagged \"field failure\nmode\", /dev/tpmrm0 is never created.\n\nSet controller->fallback before re-running spi_imx_setupxfer() so the\nECSPI is reconfigured exactly like a normal PIO transfer. With\ncontroller->fallback set, spi_imx_setupxfer() sees spi_imx_can_dma()\nreturn false, so it clears spi_imx->usedma and reprograms the controller\n(clears CTRL.SMC, restores dynamic_burst and the PIO burst length). No\nexplicit spi_imx->usedma = false is needed: setupxfer() already updates\nit from the can_dma() result."}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is in the Freescale i.MX ECSPI host driver reached only through local SPI core APIs (spidev ioctl/read/write or in-kernel spi_sync/spi_write_then_read); it is not triggered by remote network packets or adjacent radio frames.\nAC:L - On common i.MX8MP boards with ECSPI DMA enabled but SDMA firmware missing, every transfer >=64 bytes deterministically hits the DMA-prepare-fail PIO fallback; attackers can also force dmaengine_prep_slave_single() failure via DMA resource pressure without races.\nPR:L - Exploitation requires local ability to drive SPI traffic, typically via /dev/spidev group membership or unprivileged use of TPM/MTD interfaces on embedded i.MX systems; it is not reachable from unauthenticated remote network input alone.\nUI:N - No victim interaction is required; the corrupted fallback is exercised automatically during kernel driver SPI transfers (e.g., TPM probe at boot) or by the attacker's own spidev ioctl without needing another user to mount or open resources.\nS:U - Impact is confined to the same host kernel and its locally attached SPI slaves (TPM, NOR flash, sensors); it does not cross a VM, container, or IOMMU security boundary to another authority.\nC:H - Corrupted PIO RX with stale DMA burst/SMC settings delivers shifted security-peripheral responses (e.g., TPM2_GetCapability) and misaligned NOR-flash reads into kernel and userspace buffers, disclosing sensitive device data beyond correct protocol parsing.\nI:H - Stale DMA-mode CTRL settings cause corrupted SPI writes that can alter TPM commands, NOR-flash contents, and other attached secure-element or firmware-store data on i.MX ECSPI buses used in embedded and automotive deployments.\nA:H - Demonstrated total loss of TPM availability (/dev/tpmrm0 never created after shifted capability reads) and reliable breakage of all large ECSPI transfers on affected i.MX8MP SDMA-ROM configurations, denying security and storage services."}]}],"providerMetadata":{"dateUpdated":"2026-08-17T05:40:44.407Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/40dee2d3e9994aed9efe7bed40eb0e4d38d5a25c"},{"url":"https://git.kernel.org/stable/c/245404c26563aafb36aafb01298f148db1851be3"}],"title":"spi: imx: reconfigure for PIO when DMA cannot be started","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-72134","datePublished":"2026-08-15T05:53:09.573Z","dateReserved":"2026-08-09T03:40:39.907Z","dateUpdated":"2026-08-17T05:40:44.407Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-15 06:21:30","lastModifiedDate":"2026-08-17 06:18:13","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"72134","Ordinal":"1","Title":"spi: imx: reconfigure for PIO when DMA cannot be started","CVE":"CVE-2026-72134","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"72134","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: imx: reconfigure for PIO when DMA cannot be started\n\nWhen spi_imx_can_dma() selects DMA, the ECSPI is configured for DMA:\nspi_imx_setupxfer() sets CTRL.SMC and clears dynamic_burst, and\nspi_imx_dma_transfer() programs the dynamic-burst BURST_LENGTH and the\nSDMA watermarks.\n\nIf the DMA descriptor cannot be prepared (dmaengine_prep_slave_single()\nreturns NULL), the transfer is failed with SPI_TRANS_FAIL_NO_START and\nfalls back to PIO. The dynamic-burst DMA path uses its own bounce\nbuffers instead of the SPI core's mapping, so xfer->{tx,rx}_sg_mapped\nare not set and the core's DMA->PIO retry is skipped; the driver falls\nback to PIO internally. But none of the DMA-mode configuration is\nundone, so the PIO transfer runs with CTRL.SMC set, the wrong burst\nlength and dynamic_burst cleared, and the transferred data is corrupted.\n\nThis is easily hit on i.MX8MP boards that describe ECSPI DMA in the\ndevice tree but run SDMA on ROM firmware (no external sdma-imx7d.bin):\nevery ECSPI DMA prepare fails. An Infineon SLB9670 TPM on ECSPI1 then\nreturns shifted TPM2_GetCapability data, is flagged \"field failure\nmode\", /dev/tpmrm0 is never created.\n\nSet controller->fallback before re-running spi_imx_setupxfer() so the\nECSPI is reconfigured exactly like a normal PIO transfer. With\ncontroller->fallback set, spi_imx_setupxfer() sees spi_imx_can_dma()\nreturn false, so it clears spi_imx->usedma and reprograms the controller\n(clears CTRL.SMC, restores dynamic_burst and the PIO burst length). No\nexplicit spi_imx->usedma = false is needed: setupxfer() already updates\nit from the can_dma() result.","Type":"Description","Title":"spi: imx: reconfigure for PIO when DMA cannot be started"}]}}}