{"id":"CVE-2026-43319","title":"spi: spidev: fix lock inversion between spi_lock and buf_lock","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: spidev: fix lock inversion between spi_lock and buf_lock\n\nThe spidev driver previously used two mutexes, spi_lock and buf_lock,\nbut acquired them in different orde…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= a720416d94634068951773cb9e9d6f1b73769e5b < fabfed1afe273717ea33b8aee46b767360edbb80","Linux >= a720416d94634068951773cb9e9d6f1b73769e5b < f8431b8672231d378b03176fe74c95adfd3522cf","Linux >= a720416d94634068951773cb9e9d6f1b73769e5b < e341e18215030af2136836b78508e0d798916df7","Linux >= a720416d94634068951773cb9e9d6f1b73769e5b < 41ccfac7d302968a4f32b5f7b012d066c5f5cdf8","Linux >= a720416d94634068951773cb9e9d6f1b73769e5b < 40534d19ed2afb880ecf202dab26a8e7a5808d16","Linux 6.2"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T15:35:34.477270Z"},"published":"2026-05-08","updated":"2026-11-06","sourceUpdated":"2026-11-06T15:42:48.674Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43319","references":[{"url":"https://git.kernel.org/stable/c/fabfed1afe273717ea33b8aee46b767360edbb80"},{"url":"https://git.kernel.org/stable/c/f8431b8672231d378b03176fe74c95adfd3522cf"},{"url":"https://git.kernel.org/stable/c/e341e18215030af2136836b78508e0d798916df7"},{"url":"https://git.kernel.org/stable/c/41ccfac7d302968a4f32b5f7b012d066c5f5cdf8"},{"url":"https://git.kernel.org/stable/c/40534d19ed2afb880ecf202dab26a8e7a5808d16"}],"tags":["cve.org"],"epss":0.00094,"epssPercentile":0.00583,"ingestedAt":"2026-11-06T15:54:03.937Z","slug":"CVE-2026-43319","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nspi: spidev: fix lock inversion between spi_lock and buf_lock\n\nThe spidev driver previously used two mutexes, spi_lock and buf_lock,\nbut acquired them in different orders depending on the code path:\n\n  write()/read(): buf_lock -> spi_lock\n  ioctl():       spi_lock -> buf_lock\n\nThis AB-BA locking pattern triggers lockdep warnings and can\ncause real deadlocks:\n\n  WARNING: possible circular locking dependency detected\n  spidev_ioctl() -> mutex_lock(&spidev->buf_lock)\n  spidev_sync_write() -> mutex_lock(&spidev->spi_lock)\n  *** DEADLOCK ***\n\nThe issue is reproducible with a simple userspace program that\nperforms write() and SPI_IOC_WR_MAX_SPEED_HZ ioctl() calls from\nseparate threads on the same spidev file descriptor.\n\nFix this by simplifying the locking model and removing the lock\ninversion entirely. spidev_sync() no longer performs any locking,\nand all callers serialize access using spi_lock.\n\nbuf_lock is removed since its functionality is fully covered by\nspi_lock, eliminating the possibility of lock ordering issues.\n\nThis removes the lock inversion and prevents deadlocks without\nchanging userspace ABI or behaviour.\n\n## Affected\n\n- `Linux >= a720416d94634068951773cb9e9d6f1b73769e5b < fabfed1afe273717ea33b8aee46b767360edbb80`\n- `Linux >= a720416d94634068951773cb9e9d6f1b73769e5b < f8431b8672231d378b03176fe74c95adfd3522cf`\n- `Linux >= a720416d94634068951773cb9e9d6f1b73769e5b < e341e18215030af2136836b78508e0d798916df7`\n- `Linux >= a720416d94634068951773cb9e9d6f1b73769e5b < 41ccfac7d302968a4f32b5f7b012d066c5f5cdf8`\n- `Linux >= a720416d94634068951773cb9e9d6f1b73769e5b < 40534d19ed2afb880ecf202dab26a8e7a5808d16`\n- `Linux 6.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}