{
  "cveId": "CVE-2024-26806",
  "url": "https://patchblox.com/security/cve/CVE-2024-26806",
  "summary": "CVE-2024-26806 is fixed in linux on 1 platform, first by DEBIAN-CVE-2024-26806, released April 4, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  spi: cadence-qspi: remove system-wide suspend he...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  spi: cadence-qspi: remove system-wide suspend helper calls from runtime PM hooks  The -\u003Eruntime_suspend() and -\u003Eruntime_resume() callbacks are not expected to call spi_controller_suspend() and spi_controller_resume(). Remove calls to those in the cadence-qspi driver.  Those helpers have two roles currently:  - They stop/start the queue, including dealing with the kworker.  - They toggle the SPI controller SPI_CONTROLLER_SUSPENDED flag. It    requires acquiring ctlr-\u003Ebus_lock_mutex.  Step one is irrelevant because cadence-qspi is not queued. Step two however has two implications:  - A deadlock occurs, because -\u003Eruntime_resume() is called in a context    where the lock is already taken (in the -\u003Eexec_op() callback, where    the usage count is incremented).  - It would disallow all operations once the device is auto-suspended.  Here is a brief call tree highlighting the mutex deadlock:  spi_mem_exec_op()         ...         spi_mem_access_start()                 mutex_lock(\u0026ctlr-\u003Ebus_lock_mutex)          cqspi_exec_mem_op()                 pm_runtime_resume_and_get()                         cqspi_resume()                                 spi_controller_resume()                                         mutex_lock(\u0026ctlr-\u003Ebus_lock_mutex)                 ...          spi_mem_access_end()                 mutex_unlock(\u0026ctlr-\u003Ebus_lock_mutex)         ...",
  "published": "2024-04-04T09:15:09Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00149,
  "epssPercentile": 0.04082,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.7.9-1",
      "fix": "DEBIAN-CVE-2024-26806",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-26806",
      "released": "2024-04-04T09:15:09Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.7.9-1",
      "fix": "DEBIAN-CVE-2024-26806",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-26806",
      "released": "2024-04-04T09:15:09Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T13:31:49Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}