CVE-2026-46203: Linux Cadence QuadSPI Unclocked Register Access Vulnerability

Technical summary

CVE-2026-46203 is a power management bug in the Linux kernel's spi/cadence-quadspi driver. During unbind operations, the driver disables the controller without first resuming it from runtime power management suspension, resulting in unclocked register access. The vulnerability stems from improper sequencing of hardware state transitions during deregistration. The issue was identified during code review of controller deregistration logic and is addressed by adding a runtime_pm_get_sync() call before the disable operation to ensure the controller is clocked and accessible.

Business impact

Systems relying on Cadence QuadSPI controllers for SPI flash memory access (common in embedded Linux systems, IoT devices, and automotive platforms) may experience unexpected behavior during driver unload events. Potential impacts include kernel hangs, data corruption, or system crashes when the driver is removed or the system is shut down. Organizations managing fleets of embedded Linux devices with these controllers should prioritize assessment and patching to prevent field failures and support escalations.

Affected systems

The Linux kernel is affected across versions that include the vulnerable cadence-quadspi driver. Systems using Cadence QuadSPI controllers for SPI NOR flash access are at risk. This includes embedded Linux deployments, industrial controllers, automotive systems, and network appliances that rely on this driver for boot firmware or data storage access. Desktop and server systems are less commonly affected unless they include specialized SPI controller hardware.

Exploitability

Exploitation requires local access to the system and the ability to trigger driver unbind operations, such as through sysfs manipulation or system shutdown sequences. An unprivileged local user cannot directly exploit this; however, any user with privileges to unload kernel modules or trigger system state changes could inadvertently trigger the flaw. The vulnerability is more likely to manifest during normal system operations like reboot or driver reload rather than through deliberate attack, making opportunistic triggering feasible in multi-user environments.

Remediation

Apply the kernel patch that adds runtime power management resumption before controller disable during unbind. The fix ensures the controller is in an active, clocked state before register access occurs. Verify the patch version against the official Linux kernel repository and your distribution's security advisories. Kernel rebuilds may be necessary for systems running custom kernels. Test updates in non-production environments to confirm stability with your specific SPI controller hardware before broad deployment.

Patch guidance

Obtain the patched kernel version from your Linux distribution's security repository or kernel.org. The fix involves ensuring runtime_pm_get_sync() is called on the controller before attempting disable operations. Check your vendor's kernel update timeline and apply through standard package management (apt, yum, zypper, etc.). For embedded or customized kernels, refer to the Linux kernel mainline commit addressing this issue and backport if necessary. Verify the patch through your distribution's release notes or security advisory documentation.

Detection guidance

Monitor system logs for kernel warnings or errors related to cadence-quadspi driver operations, particularly during driver unload or system shutdown. Look for clock-related error messages or register access warnings. On affected systems, isolate driver load/unload events and note any kernel warnings or system instability correlated with these operations. Implement monitoring for unexpected system hangs or crashes during reboot cycles on systems with Cadence QuadSPI hardware. Kernel debugging tools and dmesg examination are primary detection methods; runtime behavioral indicators may be subtle unless corruption occurs.

Why prioritize this

Although not yet on the CISA Known Exploited Vulnerabilities catalog, the HIGH severity rating (7.1 CVSS) and impact on data integrity warrant prompt attention. The vulnerability affects core SPI flash access in embedded systems, where controller failures can cascade into boot failures or data loss. Organizations with Cadence QuadSPI-dependent infrastructure should prioritize this during regular patch cycles to prevent unexpected downtime and ensure system reliability during routine maintenance operations.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH) reflects: local attack vector (AV:L), low attack complexity (AC:L), low privilege requirements (PR:L), no user interaction (UI:N), unchanged scope (S:U), high confidentiality impact (C:H), no integrity impact (I:N), and high availability impact (A:H). The high confidentiality and availability impacts are driven by the potential for information disclosure through unclocked access and system unavailability through crashes or hangs. The local privilege requirement and local attack surface limit the score from critical, but the combination of data exposure and system instability justifies the HIGH severity rating.

Frequently asked questions