When the imx SPI driver attempts a DMA transfer but the DMA preparation fails, it leaves the controller configured for DMA, including a mis‑set burst length and a cleared dynamic burst flag. The driver then internally falls back to PIO, but the DMA‑only settings remain active, so subsequent PIO transfers use an incorrect register state and produce corrupted data. This corruption can cause malfunction of devices such as TPMs, leading to integrity violations in applications that depend on accurate SPI communication.

The flaw affects the Linux kernel’s imx SPI driver on i.MX platforms that expose ECSPI DMA entries in the device tree but lack a functional SDMA controller. Typical affected hosts include i.MX8MP boards and other i.MX8 family devices running legacy ROM firmware without an SDMA binary, as well as systems that connect Infineon SLB9670 TPMs to ECSPI1. Any Linux kernel containing the unpatched imx SPI driver that runs on such hardware will experience corrupted SPI transfers after a DMA‑initialisation failure.

The issue manifests only when a DMA transaction prepares unsuccessfully on hardware that reports DMA capability, so the attack surface is limited to the local machine or a system with privileged access to the kernel. The CVSS score is 7.8 and the EPSS score is < 1%, indicating a moderate severity but low likelihood of exploitation. There is no remote exploitation vector and the flaw is not listed in the CISA KEV catalog, suggesting no confirmed exploitation. Nevertheless, devices that rely on SPI for security‑critical operations should consider the kernel update as a priority.