Description

In the Linux kernel, the following vulnerability has been resolved: Input: psxpad-spi - set driver data before use psxpad_spi_suspend() retrieves the controller state with spi_get_drvdata(), but probe never stores it, so suspend dereferences a NULL pointer. Store it during probe.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-09-03T13:06:14.883Z",
  "pubdate": "2026-09-03T13:06:14.883Z",
  "executiveSummary": "A NULL pointer dereference vulnerability exists within the Linux kernel's psxpad-spi driver. The flaw originates from an improper initialization sequence during the device probing process.\nSpecifically, the driver fails to associate the controller state object with the SPI device structure via spi_set_drvdata() during the probe phase.\nThe vulnerability manifests when the psxpad_spi_suspend() function is invoked, which attempts to retrieve the driver data using spi_get_drvdata(). Because the pointer remains uninitialized (NULL), the kernel attempts to dereference a null memory address, resulting in a system crash or kernel panic.\nThe impact is a denial-of-service (DoS) condition on the affected system. Successful exploitation typically requires the attacker to trigger a suspend event on a system where this specific driver is loaded.\nThe vulnerability affects the Linux kernel psxpad-spi driver implementation. No specific authentication is required, as the fault is triggered by standard power management state transitions.",
  "technicalDetails": "The root cause of this vulnerability is a state consistency error in the Linux kernel's psxpad-spi driver component. In standard Linux SPI (Serial Peripheral Interface) driver design, the driver is expected to store a pointer to its private data structure within the spi_device object during the probe sequence. This is achieved by calling spi_set_drvdata(spi, data).\nIn the affected version of the psxpad-spi driver, the probe function fails to execute this assignment. Consequently, the internal storage for the driver data within the SPI structure is never populated and remains NULL.\nThe attack vector is triggered during the power management lifecycle, specifically when the system initiates a suspend operation. The kernel calls the psxpad_spi_suspend() function to prepare the hardware for a low-power state. Inside this function, the driver invokes spi_get_drvdata(spi) to access the controller state. Because the initial probe neglected to populate this field, the function returns a NULL pointer.\nThe vulnerability is realized when the driver proceeds to dereference this NULL pointer. In the context of the Linux kernel, accessing address 0x0 results in an immediate exception. If the kernel is not configured to handle this fault gracefully, it triggers a kernel panic, leading to an immediate system crash and denial of service.\nFrom an exploitation perspective, this is a local denial-of-service vulnerability. An attacker with local access to the system, or a user-space process capable of triggering power management events (e.g., via /sys/power/state), can force the kernel to execute the vulnerable suspend path. The requirement for physical or local interaction makes this a significant stability risk for embedded systems utilizing the psxpad-spi driver, particularly if the hardware is configured to trigger automatic suspend cycles.\nThis vulnerability highlights a common pitfall in kernel module development where initialization order is violated. Because the driver assumes the persistence of the drvdata pointer, it lacks input validation checks to verify if the returned pointer is valid before performing memory operations. This lack of defensive programming allows a simple pointer dereference to propagate into a system-wide instability event."
}