CVE-2026-46192 Details
Description
In the Linux kernel, the following vulnerability has been resolved: spi: microchip-core-qspi: don't attempt to transmit during emulated read-only dual/quad operations The core will deal with reads by creating clock cycles itself, there's no need to generate clock cycles by transmitting garbage data at the driver level. Further, transmitting garbage data just bricks the transfer since QSPI doesn't have a dedicated master-out line like MOSI in regular SPI. I'm not entirely sure if the transfer is bricked because of the garbage data being transmitted on the bus or because the core loses track of whether it is supposed to be sending or receiving data.
A vulnerability in the Linux kernel's SPI microchip-core-QSPI driver has been addressed. The issue arose because the driver improperly handled emulated read-only dual and quad operations by transmitting unnecessary data, which interfered with the transfer process. Unlike standard SPI, QSPI lacks a dedicated master-out line, causing the transfer to fail. The problem was exacerbated by the core losing track of the data transmission state. The vulnerability affected the Linux kernel stable tree.
Users can update to the latest version of the Linux kernel stable tree, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/67184f361ab4d9fac6d2b8d5fed6649d496038a4 | kernel.org | Patch |
| https://git.kernel.org/stable/c/eb56deaabf127e8985fc91fa6c97bf8a3b062844 | kernel.org | Patch |
| https://git.kernel.org/stable/c/ec9d0ddbde6003c303fa5e1d5cd48952852984d8 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.17, < 6.18.30 >= 6.19, < 7.0.7 7.1 rc1 7.1 rc2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 11, 2026 | Initial Analysis | [email protected] |
| May 28, 2026 | New CVE Received | kernel.org |