---
id: "CVE-2026-99164"
kind: "vulnerability"
aliases: ["CVE-2026-99164"]
title: "Linux kernel: i.MX SPI DMA buffers undersized, corrupting slab memory"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["embedded", "imx8mp", "linux-kernel", "other"]
not_affected_if: ["dma-mode-off", "no-imx-spi"]
published_at: "2026-10-28T11:17:36+00:00"
first_seen_at: "2026-10-28T11:32:36+00:00"
updated_at: "2026-10-28T11:35:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99164", "first_seen_at": "2026-10-28T11:32:36+00:00"}]
---

# Linux kernel: i.MX SPI DMA buffers undersized, corrupting slab memory

The i.MX SPI driver allocates its DMA bounce buffers smaller than the length it maps, so DMA operations run past the end of the allocation. On a reported i.MX8MP system this corrupted kernel memory and eventually caused crashes; the sources do not describe remote code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `uname -r` and compare against the fixed kernel release, which the sources do not name
- Check whether the i.MX ECSPI driver (spi-imx) is loaded with `lsmod | grep spi_imx` and whether DMA mode is used (unknown from sources)

## Fix

- Update to a Linux kernel build that includes the upstream commit fixing spi: imx DMA bounce buffer allocation (version unknown from sources)

## Timeline

- 2026-10-28T11:32:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99164

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

spi: imx: fix slab corruption from undersized DMA bounce buffers

Since commit faa8e404ad8e ("spi: imx: support dynamic burst length for
ECSPI DMA mode"), the driver allocates its private DMA TX/RX buffers
with kzalloc(dma_len), where dma_len is only rounded up to 4 bytes, but
maps, syncs and unmaps them with DMA_CACHE_ALIGNED_LEN(dma_len), i.e.
rounded up to the cache line size. As a result, the DMA API operates on
memory beyond the end of the allocation.

This was observed on a custom i.MX8MP platform with an mcp251xfd CAN
controller under heavy RPMSG load, as a series of refcount_t warnings
triggered from rpmsg_recv_done() in virtio_rpmsg_bus:

  refcount_t: addition on 0; use-after-free.
  refcount_t: underflow; use-after-free.
  refcount_t: saturated; leaking memory.

Leading finally to an "Unable to handle kernel paging request" oops.
Reproducing this problem took between 30 minutes and roughly 30 hours
under the same workload.

Hardware watchpoints on the refcount of a struct rpmsg_endpoint showed
it was overwritten from 2 to 1 by __pi_memcpy_generic() in the
irq/155-spi2.0 thread. Additionally it was found that a "normal"
rpmsg_recv_done() took 11µs +/-2µs from its kref_get to kref_put. In
the error case the same sequence took about 215µs +/-10µs. Based on
this, an LLM was used to identify the size mismatch fixed here.

Allocate the buffers with DMA_CACHE_ALIGNED_LEN(dma_len) so they cover
the full mapped length, and use the same length for
dma_sync_single_for_cpu() to stay consistent with map and unmap.

With this patch applied, the same workload ran for more than 200 hours
without the problem reproducing.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_