PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46203 Linux CVE debrief

A vulnerability in the Linux kernel's Cadence Quad SPI (QSPI) driver could allow unclocked register access during driver unbind operations. The issue occurs when the controller is not runtime resumed before being disabled, potentially leading to undefined behavior or system instability. The fix ensures proper runtime power management state before controller disablement.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-28
Advisory published
2026-05-28
Advisory updated
2026-05-28

Who should care

Organizations running Linux on embedded systems or hardware utilizing Cadence QSPI controllers, particularly those with hot-pluggable or dynamically bound SPI devices. Relevant for IoT device manufacturers, industrial control systems, and embedded Linux distributions.

Technical summary

The Cadence Quad SPI driver in the Linux kernel failed to ensure the controller was runtime resumed before disabling it during driver unbind. This created a window where register accesses could occur without proper clocking, constituting an unclocked access vulnerability. The fix adds proper runtime resume synchronization before controller disablement.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the referenced stable commits when available for your distribution
  • Monitor vendor security advisories for kernel package updates
  • Review systems using Cadence QSPI controllers for stability concerns during driver unload operations
  • Validate runtime power management behavior in embedded/IoT deployments using this driver

Evidence notes

The vulnerability was identified during review of a controller deregistration fix by Sashiko. The resolution involves ensuring the controller is runtime resumed before disabling it during driver unbind to prevent unclocked register access. Two kernel commits address this issue for stable kernel branches.

Official resources

2026-05-28