CVE-2026-72134 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, especially those working on the spi: imx driver, as well as users and distributors of Linux-based systems using i.MX8MP boards with ECSPI. Additionally, security teams and vulnerability management professionals responsible for ensuring the security and integrity of Linux-based systems, particularly those utilizing ECSPI DMA, should be aware of this issue and take appropriate measures to mitigate the risk. System administrators and operators of affected systems should also be informed to ensure prompt application of patches or workarounds to prevent potential data corruption and security breaches related to this vulnerability. Furthermore, organizations relying on the Infineon SLB9670 TPM on ECSPI1 should prioritize patching to prevent 'field failure mode' and creation of /dev/tpmrm0 issues. IT and security teams should review system configurations, monitor for potential data corruption issues, and implement compensating controls if necessary while awaiting remediation. This includes verifying device tree configurations, assessing the impact of SDMA on ROM firmware, and ensuring proper reconfiguration of ECSPI for PIO mode when DMA fails. Collaboration between development, security, and operations teams is crucial to address this vulnerability effectively and minimize potential disruptions to critical systems and services. The vulnerability's impact on data integrity and system security underscores the importance of prompt attention and coordinated response among all relevant stakeholders to ensure the reliability and security of Linux-based systems utilizing the affected driver and hardware configurations. This requires a proactive approach to vulnerability management, including timely patching, thorough testing, and continuous monitoring of system configurations and potential security risks associated with the spi: imx driver and ECSPI DMA functionality. By prioritizing awareness and mitigation of this vulnerability, organizations can reduce the risk of data corruption, security breaches, and operational disruptions, ultimately enhancing the overall security posture of their Linux-based infrastructure and protecting the

Technical summary

The spi: imx driver in the Linux kernel fails to properly reconfigure the ECSPI when DMA cannot be started, leading to data corruption. The driver sets up the ECSPI for DMA mode but does not undo this configuration when falling back to PIO mode due to DMA descriptor preparation failure. This issue is particularly relevant for i.MX8MP boards with ECSPI DMA described in the device tree but running SDMA on ROM firmware, which cannot prepare external DMA descriptors.

Defensive priority

High

Recommended defensive actions

• Review and apply the provided kernel patches to ensure proper reconfiguration of ECSPI for PIO mode when DMA fails.
• Verify that the device tree accurately reflects the DMA capabilities of the ECSPI on affected systems.
• Monitor for and address any potential data corruption issues related to ECSPI transfers on i.MX8MP boards.
• Perform a thorough review of system configurations to identify potential security risks associated with the spi: imx driver and ECSPI DMA functionality.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability exists in the spi: imx driver of the Linux kernel. When DMA fails to start, the driver incorrectly falls back to PIO mode without properly reconfiguring the ECSPI. This results in corrupted data being transferred. The issue is particularly problematic for i.MX8MP boards that describe ECSPI DMA in the device tree but rely on SDMA from ROM firmware, which fails to prepare DMA descriptors.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.