Description
In the Linux kernel, the following vulnerability has been resolved:

spi: core: Abort active target transfer on controller suspend

When an SPI controller operating in target mode has a transfer in
progress at the time of system suspend, the suspend path proceeds
without aborting the ongoing transfer. This can leave the hardware in
an inconsistent state, potentially causing the system to hang or fail
to resume cleanly.

Fix this by invoking the controller's target_abort callback from
spi_controller_suspend() when the controller is in target mode and the
callback is registered. This ensures any active target transfer is
cleanly terminated before the controller is suspended.
Published: 2026-09-24
Score: n/a
EPSS: n/a
KEV: No
Impact: System hang or resume failure
Action: Apply Patch
AI Analysis

Impact

This kernel bug causes an SPI controller in target mode to continue an active transfer when the system is suspended. The ongoing transfer is not aborted, leaving the hardware in an inconsistent state. As a result the system can freeze or fail to resume cleanly, effectively creating a denial‑of‑service situation for the host.

Affected Systems

All Linux kernel builds before the published fix are vulnerable. The issue applies to the kernel source for all distributions that ship the unpatched version, as the affected code path is common to all Linux kernels.

Risk and Exploitability

The exploitability is limited to systems that are powered on and then suspended while an SPI target transfer is in progress. The vulnerability requires kernel privileges to influence the transfer state, so it is not trivially exploitable by an unprivileged process. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the impact of a successful exploit is a system freeze or failed resume.

Generated by OpenCVE AI on September 25, 2026 at 03:03 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the kernel update that implements the target_abort call in spi_controller_suspend()
  • Upgrade to the newest stable Linux kernel that contains the fix for the vendor
  • If necessary, make sure no active SPI target transfers are in flight before initiating system suspend, or disable target mode when possible

Generated by OpenCVE AI on September 25, 2026 at 03:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 25 Sep 2026 03:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362
CWE-404

Thu, 24 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: spi: core: Abort active target transfer on controller suspend When an SPI controller operating in target mode has a transfer in progress at the time of system suspend, the suspend path proceeds without aborting the ongoing transfer. This can leave the hardware in an inconsistent state, potentially causing the system to hang or fail to resume cleanly. Fix this by invoking the controller's target_abort callback from spi_controller_suspend() when the controller is in target mode and the callback is registered. This ensures any active target transfer is cleanly terminated before the controller is suspended.
Title spi: core: Abort active target transfer on controller suspend
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-24T16:02:50.963Z

Reserved: 2026-09-18T17:59:28.790Z

Link: CVE-2026-93814

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-24T17:17:14.897

Modified: 2026-09-24T17:17:14.897

Link: CVE-2026-93814

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T03:15:14Z

Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

  • CWE-404

    Improper Resource Shutdown or Release