---
id: CVE-2026-43319
title: 'spi: spidev: fix lock inversion between spi_lock and buf_lock'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  spi: spidev: fix lock inversion between spi_lock and buf_lock

  The spidev driver previously used two mutexes, spi_lock and buf_lock,
  but acquired them in different orde…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a720416d94634068951773cb9e9d6f1b73769e5b <
    fabfed1afe273717ea33b8aee46b767360edbb80
  - >-
    Linux >= a720416d94634068951773cb9e9d6f1b73769e5b <
    f8431b8672231d378b03176fe74c95adfd3522cf
  - >-
    Linux >= a720416d94634068951773cb9e9d6f1b73769e5b <
    e341e18215030af2136836b78508e0d798916df7
  - >-
    Linux >= a720416d94634068951773cb9e9d6f1b73769e5b <
    41ccfac7d302968a4f32b5f7b012d066c5f5cdf8
  - >-
    Linux >= a720416d94634068951773cb9e9d6f1b73769e5b <
    40534d19ed2afb880ecf202dab26a8e7a5808d16
  - Linux 6.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T15:35:34.477270Z'
published: '2026-05-08'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:42:48.674Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43319'
references:
  - url: 'https://git.kernel.org/stable/c/fabfed1afe273717ea33b8aee46b767360edbb80'
  - url: 'https://git.kernel.org/stable/c/f8431b8672231d378b03176fe74c95adfd3522cf'
  - url: 'https://git.kernel.org/stable/c/e341e18215030af2136836b78508e0d798916df7'
  - url: 'https://git.kernel.org/stable/c/41ccfac7d302968a4f32b5f7b012d066c5f5cdf8'
  - url: 'https://git.kernel.org/stable/c/40534d19ed2afb880ecf202dab26a8e7a5808d16'
tags:
  - cve.org
epss: 0.00094
epssPercentile: 0.00583
ingestedAt: '2026-11-06T15:54:03.937Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

spi: spidev: fix lock inversion between spi_lock and buf_lock

The spidev driver previously used two mutexes, spi_lock and buf_lock,
but acquired them in different orders depending on the code path:

  write()/read(): buf_lock -> spi_lock
  ioctl():       spi_lock -> buf_lock

This AB-BA locking pattern triggers lockdep warnings and can
cause real deadlocks:

  WARNING: possible circular locking dependency detected
  spidev_ioctl() -> mutex_lock(&spidev->buf_lock)
  spidev_sync_write() -> mutex_lock(&spidev->spi_lock)
  *** DEADLOCK ***

The issue is reproducible with a simple userspace program that
performs write() and SPI_IOC_WR_MAX_SPEED_HZ ioctl() calls from
separate threads on the same spidev file descriptor.

Fix this by simplifying the locking model and removing the lock
inversion entirely. spidev_sync() no longer performs any locking,
and all callers serialize access using spi_lock.

buf_lock is removed since its functionality is fully covered by
spi_lock, eliminating the possibility of lock ordering issues.

This removes the lock inversion and prevents deadlocks without
changing userspace ABI or behaviour.

## Affected

- `Linux >= a720416d94634068951773cb9e9d6f1b73769e5b < fabfed1afe273717ea33b8aee46b767360edbb80`
- `Linux >= a720416d94634068951773cb9e9d6f1b73769e5b < f8431b8672231d378b03176fe74c95adfd3522cf`
- `Linux >= a720416d94634068951773cb9e9d6f1b73769e5b < e341e18215030af2136836b78508e0d798916df7`
- `Linux >= a720416d94634068951773cb9e9d6f1b73769e5b < 41ccfac7d302968a4f32b5f7b012d066c5f5cdf8`
- `Linux >= a720416d94634068951773cb9e9d6f1b73769e5b < 40534d19ed2afb880ecf202dab26a8e7a5808d16`
- `Linux 6.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.