{"id":"CVE-2024-26807","summary":"spi: cadence-qspi: fix pointer reference in runtime PM hooks","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nBoth cadence-quadspi -\u003eruntime_suspend() and -\u003eruntime_resume()\nimplementations start with:\n\n\tstruct cqspi_st *cqspi = dev_get_drvdata(dev);\n\tstruct spi_controller *host = dev_get_drvdata(dev);\n\nThis obviously cannot be correct, unless \"struct cqspi_st\" is the\nfirst member of \" struct spi_controller\", or the other way around, but\nit is not the case. \"struct spi_controller\" is allocated by\ndevm_spi_alloc_host(), which allocates an extra amount of memory for\nprivate data, used to store \"struct cqspi_st\".\n\nThe -\u003eprobe() function of the cadence-quadspi driver then sets the\ndevice drvdata to store the address of the \"struct cqspi_st\"\nstructure. Therefore:\n\n\tstruct cqspi_st *cqspi = dev_get_drvdata(dev);\n\nis correct, but:\n\n\tstruct spi_controller *host = dev_get_drvdata(dev);\n\nis not, as it makes \"host\" point not to a \"struct spi_controller\" but\nto the same \"struct cqspi_st\" structure as above.\n\nThis obviously leads to bad things (memory corruption, kernel crashes)\ndirectly during -\u003eprobe(), as -\u003eprobe() enables the device using PM\nruntime, leading the -\u003eruntime_resume() hook being called, which in\nturns calls spi_controller_resume() with the wrong pointer.\n\nThis has at least been reported [0] to cause a kernel crash, but the\nexact behavior will depend on the memory contents.\n\n[0] https://lore.kernel.org/all/20240226121803.5a7r5wkpbbowcxgx@dhruva/\n\nThis issue potentially affects all platforms that are currently using\nthe cadence-quadspi driver.","modified":"2026-04-02T10:05:59.160292Z","published":"2024-04-04T08:20:34.155Z","related":["SUSE-SU-2024:1490-1","SUSE-SU-2024:1659-1","SUSE-SU-2024:1663-1","SUSE-SU-2024:2135-1","SUSE-SU-2024:2203-1","SUSE-SU-2024:2973-1","SUSE-SU-2025:20008-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26807.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/03f1573c9587029730ca68503f5062105b122f61"},{"type":"WEB","url":"https://git.kernel.org/stable/c/2c914aac9522f6e93822c18dff233d3e92399c81"},{"type":"WEB","url":"https://git.kernel.org/stable/c/32ce3bb57b6b402de2aec1012511e7ac4e7449dc"},{"type":"WEB","url":"https://git.kernel.org/stable/c/34e1d5c4407c78de0e3473e1fbf8fb74dbe66d03"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26807.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26807"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"79acf7fb856eade9c3d0cf00fd34a04bf5c43a1c"},{"fixed":"2c914aac9522f6e93822c18dff233d3e92399c81"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"2087e85bb66ee3652dafe732bb9b9b896229eafc"},{"fixed":"03f1573c9587029730ca68503f5062105b122f61"},{"fixed":"34e1d5c4407c78de0e3473e1fbf8fb74dbe66d03"},{"fixed":"32ce3bb57b6b402de2aec1012511e7ac4e7449dc"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"0"},{"last_affected":"e3f9fc9a4f1499cc9e1bad4482d377494e367b3d"},{"last_affected":"6716203844bc8489af5e5564f0fa31e0c094a7ff"},{"last_affected":"b24f1ecc8fe2ceefc14af02edb1744c246d87bf7"},{"last_affected":"d453f25faf681799d636fe9d6899ad91c45aa11e"},{"last_affected":"18cb554e9da81bc4eca653c17a0d65e8b5835c09"},{"last_affected":"1368dbc0a432acf9fc0dcb23bfe52d32ca4c09ab"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26807.json"}}],"schema_version":"1.7.5"}