Deadlock Vulnerability in Cadence QSPI Driver of Linux Package
Summary
DEBIAN-CVE-2024-26806: In the Linux kernel, the following vulnerability has been resolved: spi: cadence-qspi: remove system-wide suspend helper calls from runtime PM hooks The ->runtime_suspend() and ->runtime_resume() callbacks are not expect... Affects linux versions < 6.7.9-1. Fixed in 6.7.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. The cadence-qspi driver is responsible for managing the Quad Serial Peripheral Interface (QSPI) devices, enabling high-speed data transfer between the CPU and peripheral devices. This driver is crucial for applications requiring efficient communication with flash memory and other SPI devices. However, it has been identified that the driver contains a vulnerability that can lead to deadlock situations, affecting system stability.
Vulnerability Detail
In the cadence-qspi driver of the Linux kernel, a vulnerability exists where the runtime suspend and resume callbacks improperly call the spi_controller_suspend() and spi_controller_resume() functions. This can lead to a deadlock because the ->runtime_resume() function is invoked while holding a mutex lock that is also required by the resume function. The implications of this vulnerability include potential system hangs and the inability to perform operations on devices that are auto-suspended, severely impacting system performance and reliability.
How To Fix
Minimum fixed version
6.7.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to avoid potential deadlock issues.
Conclusion
The cadence-qspi driver in the Linux kernel has a critical vulnerability that can lead to deadlocks, impacting system stability. Users are advised to update to the patched version to ensure system reliability and performance. Monitoring tools like Vulert can assist in identifying vulnerabilities in your applications.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a deadlock issue in the cadence-qspi driver of the Linux kernel, caused by improper calls to suspend and resume functions.
It can lead to system hangs and prevent operations on auto-suspended devices, affecting overall system performance.
Yes, the vulnerability has been patched in version 6.7.9-1 of the Linux package.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
While there are no specific workarounds, it is crucial to prioritize updating the package to mitigate the risk of deadlock.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
