CVE-2026-23202: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23202 is a race condition vulnerability in the Linux kernel's spi: tegra210-quad driver that can lead to NULL pointer dereference or use-after-free conditions. The flaw exists in the tegra_qspi_combined_seq_xfer() function, where the curr_xfer field is cleared without holding the spinlock, creating a race with the IRQ handler that reads this field. Affected kernel versions include 5.15.198–5.15.199, 6.1.160–6.1.162, 6.6.120–6.6.123, 6.12.63–6.12.69, 6.17.13–6.17.x, 6.18.2–6.18.9, and pre-release 6.19-rc1 through rc8. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is a missing spinlock protection (CWE-476: NULL Pointer Dereference) when clearing the curr_xfer field in the exit path of tegra_qspi_combined_seq_xfer(). The IRQ handler reads curr_xfer without holding the lock to determine whether a transfer is in progress; if the main thread clears this pointer concurrently, the IRQ handler may dereference a NULL or stale pointer. Exploitation requires local access and low privileges, as an attacker would need to trigger the race condition between the combined sequence transfer loop and the interrupt handler. The fix involves wrapping the curr_xfer clearing operation with the existing spinlock (Feedly, Kernel Patch).

Successful exploitation can cause a kernel NULL pointer dereference or use-after-free, resulting in a system crash (kernel panic) and denial of service. The vulnerability has no confidentiality or integrity impact — only availability is affected, as the kernel crash would render the system unavailable until rebooted. The scope is limited to the local system running an affected kernel with the Tegra210 QSPI hardware driver active (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-23202. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained to local, low-privileged attackers on systems with Tegra210 QSPI hardware, significantly limiting the attack surface (Feedly).

The Linux kernel maintainers have released patches addressing this vulnerability across multiple stable branches. Fixed versions include 5.15.200, 6.1.163, 6.6.124, 6.12.70, 6.18.10, and the upstream fix is included in 6.19 stable. Downstream distributions including Debian, Ubuntu, SUSE, and Oracle Linux have issued updated kernel packages. Administrators should apply the latest kernel update for their distribution as soon as possible; no configuration-based workaround is available (Kernel Patch, Debian LTS, OpenSUSE).