CVE-2024-42249: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-42249 affects the Linux kernel's SPI (Serial Peripheral Interface) subsystem. The vulnerability was discovered in the spiasync() function where an incorrect call to spimaybeunoptimizemessage() could corrupt messages while they are being processed by the controller driver. This issue affects Linux kernel versions from 6.9 up to (excluding) 6.9.10 (NVD).

The vulnerability stems from a timing issue in the SPI message handling. The spimaybeunoptimizemessage() function is called in spiasync() while the message is likely still in the queue and not yet transferred, which can lead to message corruption during controller driver processing. The function is already properly called in spifinalizecurrentmessage() to balance the call to spimaybeoptimizemessage() in spi_async() (Kernel Patch). The vulnerability has been assigned a CVSS v3.1 base score of 3.3 (LOW) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (NVD).

The vulnerability can lead to message corruption while being processed by the controller driver, potentially causing data integrity issues in SPI communications. The impact is limited to local systems with low privileges required for exploitation (NVD).

The vulnerability has been fixed by removing the incorrect call to spimaybeunoptimizemessage() in spiasync(). Users should upgrade to Linux kernel version 6.9.10 or later which contains the fix (Kernel Patch).