CVE-2026-23202 spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer

What is CVE-2026-23202?

CVE-2026-23202 is a medium-severity vulnerability in Linux kernel, published on 14 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer

The curr_xfer field is read by the IRQ handler without holding the lock to check if a transfer is in progress. When clearing curr_xfer in the combined sequence transfer loop, protect it with the spinlock to prevent a race with the interrupt handler.

Protect the curr_xfer clearing at the exit path of tegra_qspi_combined_seq_xfer() with the spinlock to prevent a race with the interrupt handler that reads this field.

Without this protection, the IRQ handler could read a partially updated curr_xfer value, leading to NULL pointer dereference or use-after-free.

Weakness: CWE-476, CWE-362

Which versions are affected by CVE-2026-23202?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2026-23202?

Apply the vendor's patch.

Is CVE-2026-23202 being exploited?

There is no known exploitation of CVE-2026-23202 in the wild and no public exploit code.

Other vulnerabilities in Linux kernel

• CVE-2026-53266 Linux Kernel Out-of-Bounds Write Exploited High 8.8
• CVE-2013-6282 Linux Kernel Improper Input Validation Exploited High 8.8
• CVE-2022-0185 Linux Kernel Heap-Based Buffer Overflow Exploited High 8.4
• CVE-2013-2094 Linux Kernel Privilege Escalation Exploited High 8.4
• CVE-2026-53362 Linux Kernel Unspecified Exploited High 7.8

All Linux kernel vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BELL-CVE-2026-23202, DEBIAN-CVE-2026-23202, GHSA-g2fg-h3fh-wpj6, ROOT-OS-DEBIAN-12-CVE-2026-23202, ROOT-OS-DEBIAN-13-CVE-2026-23202, ROOT-OS-UBUNTU-2204-CVE-2026-23202 and 1 more.