CVE-2026-46203: spi: cadence-quadspi: fix unclocked access on unbind

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-28 · updated 2026-06-19
Weakness: CWE-125

Description

In the Linux kernel, the following vulnerability has been resolved: spi: cadence-quadspi: fix unclocked access on unbind Make sure that the controller is runtime resumed before disabling it during driver unbind to avoid an unclocked register access. This issue was flagged by Sashiko when reviewing a controller deregistration fix.

Affected products

Linux kernel: from 6.7 before 7.0.9; 7.1-rc1 — fixed in 7.0.9

How to fix

Upgrade to a fixed version: Linux kernel 7.0.9. Check the vendor advisory for mitigations.

References

https://git.kernel.org/stable/c/233db2cb14db8b1935dda52a6affd97276462b82
https://git.kernel.org/stable/c/2e7cd62c37f51823c2bb79de1d4d76d0c1678c7e
https://git.kernel.org/stable/c/63a9f6012f453578898c9fcc13c8452a8651104e
https://git.kernel.org/stable/c/d67a5311818b3e6481a1e4293c9337ebfee73111

Get alerted when CVE-2026-46203 or the next vulnerability affects your stack