Description
In the Linux kernel, the following vulnerability has been resolved:

spi: xilinx: use FIFO occupancy register to determine buffer size

The method the driver uses to determine the size of the FIFO has a
problem. What it currently does is this:
It stops the SPI hardware and writes to the TX FIFO register until TX
FIFO FULL asserts in the status register. But the hardware does not only
have the FIFO, it also has a shift register which can hold a byte. This
can be seen, when writing a byte to the FIFO (while the SPI hardware is
stopped,) the TX FIFO EMPTY is still empty. So, if we have a FIFO size
of 16 for example, the current method returns a 17.
This is a problem, at least when using the driver in irq mode. The same
size determined for the TX FIFO is also assumed for the RX FIFO. When a
SPI transaction wants to write the amount of the FIFO size or more
bytes, the following happens, for example with 16 bytes FIFO size:
The driver stops the SPI hardware and writes 17 bytes to the TX FIFO and
starts the SPI hardware and goes sleep.
The hardware then shifts out 17 bytes (FIFO + shift register) and
simultaneously reads bytes into the RX FIFO, but it only has 16 places,
so it looses one byte. Then TX FIFO empty asserts, wakes the driver
again, which has a fast path and reads 16 bytes from the RX FIFO, but
before reading the last 17th byte (which is lost) it does this:

sr = xspi->read_fn(xspi->regs + XSPI_SR_OFFSET);
if (!(sr & XSPI_SR_RX_EMPTY_MASK)) {
xilinx_spi_rx(xspi);
rx_words--;
}

It reads the status register and checks if the RX FIFO is not empty.
But it is empty in our case. So this check spins in a while loop
forever locking the driver.

This patch fixes the logic to determine the FIFO size.
Published: 2026-08-15
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Xilinx SPI driver calculates the FIFO capacity by writing into the TX FIFO until the TX FIFO FULL status is set. Because the hardware shift register also holds a byte, this method counts an extra byte and reports a FIFO size that is one larger than the real one. When a transaction writes more bytes than the true FIFO capacity, the driver writes an extra byte into the TX FIFO, the hardware shifts it out and writes a byte to the RX FIFO that has no space. The lost byte causes the driver to enter an endless spin while it waits for a byte that will never arrive, effectively locking the driver.

Affected Systems

Any Linux kernel build that includes the Xilinx SPI driver is affected. The flaw exists in the generic Xilinx SPI driver code and is present in all kernel versions prior to the patch that fixes FIFO size detection. Devices that use SPI peripherals managed by this driver can be impacted.

Risk and Exploitability

The CVSS score is 5.5 and the EPSS score is <1%. The bug only causes a service interruption by locking the driver; there is no privilege escalation or data leakage. An attacker that can initiate SPI transfers on the affected device can trigger the lockup, resulting in an availability denial. The vulnerability is not listed in CISA’s KEV catalog, and no workaround is provided by the vendor.

Generated by OpenCVE AI on August 22, 2026 at 03:47 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest kernel release that incorporates the FIFO size fix.
  • If updating is not immediately possible, unload or blacklist the xilinx_spi driver to stop the driver from loading, or disable the relevant device entry in the device tree.
  • Monitor system logs (e.g., dmesg, journalctl) for messages indicating driver spinning or watchdog resets, and plan a timely patch deployment.

Generated by OpenCVE AI on August 22, 2026 at 03:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 22 Aug 2026 02:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-749

Wed, 19 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-835
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Sat, 15 Aug 2026 13:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-749

Sat, 15 Aug 2026 06:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: spi: xilinx: use FIFO occupancy register to determine buffer size The method the driver uses to determine the size of the FIFO has a problem. What it currently does is this: It stops the SPI hardware and writes to the TX FIFO register until TX FIFO FULL asserts in the status register. But the hardware does not only have the FIFO, it also has a shift register which can hold a byte. This can be seen, when writing a byte to the FIFO (while the SPI hardware is stopped,) the TX FIFO EMPTY is still empty. So, if we have a FIFO size of 16 for example, the current method returns a 17. This is a problem, at least when using the driver in irq mode. The same size determined for the TX FIFO is also assumed for the RX FIFO. When a SPI transaction wants to write the amount of the FIFO size or more bytes, the following happens, for example with 16 bytes FIFO size: The driver stops the SPI hardware and writes 17 bytes to the TX FIFO and starts the SPI hardware and goes sleep. The hardware then shifts out 17 bytes (FIFO + shift register) and simultaneously reads bytes into the RX FIFO, but it only has 16 places, so it looses one byte. Then TX FIFO empty asserts, wakes the driver again, which has a fast path and reads 16 bytes from the RX FIFO, but before reading the last 17th byte (which is lost) it does this: sr = xspi->read_fn(xspi->regs + XSPI_SR_OFFSET); if (!(sr & XSPI_SR_RX_EMPTY_MASK)) { xilinx_spi_rx(xspi); rx_words--; } It reads the status register and checks if the RX FIFO is not empty. But it is empty in our case. So this check spins in a while loop forever locking the driver. This patch fixes the logic to determine the FIFO size.
Title spi: xilinx: use FIFO occupancy register to determine buffer size
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-17T05:16:20.426Z

Reserved: 2026-08-15T05:44:03.880Z

Link: CVE-2026-74276

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T06:22:26.993

Modified: 2026-08-17T06:19:21.287

Link: CVE-2026-74276

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74276 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-22T04:00:12Z

Weaknesses
  • CWE-835

    Loop with Unreachable Exit Condition ('Infinite Loop')