In the Linux kernel, the following vulnerability has been resolved: spi: tegra210-quad: Fix timeout handling When the CPU that the QSPI interrupt… (CVE-2025-68746)
A vulnerability in the Linux kernel's tegra210-quad SPI driver involves improper timeout handling in the QSPI interrupt handler. When the CPU running the interrupt handler is heavily loaded, the IRQ thread may not execute before a transfer timeout occurs, leading to stale memory references. This can cause corruption and failure in SPI message handling. The issue has been addressed by clearing the current transfer pointer upon timeout and ensuring interrupts are cleared on failure to allow new interrupts to be processed.
AI Analysis
Technical Summary
The Linux kernel vulnerability CVE-2025-68746 affects the tegra210-quad SPI driver. Under high CPU load, the QSPI interrupt handler's IRQ thread may not run before a transfer timeout, causing the current transfer pointer (curr_xfer) to reference stale memory. This improper handling can lead to corrupted SPI message processing and system instability. The fix involves clearing curr_xfer to NULL upon timeout and clearing interrupts on failure to enable proper interrupt handling. A more comprehensive fix would involve moving interrupt clearing to a hard IRQ handler and signaling that the IRQ thread is no longer needed after timeout.
Potential Impact
This vulnerability can cause high impact including confidentiality, integrity, and availability issues due to corrupted SPI message handling and potential system instability. The stale memory reference may lead to failed transfers and unpredictable behavior in affected systems using the tegra210-quad SPI driver.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The description indicates a fix has been implemented in the Linux kernel source code, but no explicit patch link or vendor advisory is provided. Users should monitor official Linux kernel updates and apply relevant patches when available.
In the Linux kernel, the following vulnerability has been resolved: spi: tegra210-quad: Fix timeout handling When the CPU that the QSPI interrupt… (CVE-2025-68746)
Description
A vulnerability in the Linux kernel's tegra210-quad SPI driver involves improper timeout handling in the QSPI interrupt handler. When the CPU running the interrupt handler is heavily loaded, the IRQ thread may not execute before a transfer timeout occurs, leading to stale memory references. This can cause corruption and failure in SPI message handling. The issue has been addressed by clearing the current transfer pointer upon timeout and ensuring interrupts are cleared on failure to allow new interrupts to be processed.
CVSS v3.1
Score 7.8high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel vulnerability CVE-2025-68746 affects the tegra210-quad SPI driver. Under high CPU load, the QSPI interrupt handler's IRQ thread may not run before a transfer timeout, causing the current transfer pointer (curr_xfer) to reference stale memory. This improper handling can lead to corrupted SPI message processing and system instability. The fix involves clearing curr_xfer to NULL upon timeout and clearing interrupts on failure to enable proper interrupt handling. A more comprehensive fix would involve moving interrupt clearing to a hard IRQ handler and signaling that the IRQ thread is no longer needed after timeout.
Potential Impact
This vulnerability can cause high impact including confidentiality, integrity, and availability issues due to corrupted SPI message handling and potential system instability. The stale memory reference may lead to failed transfers and unpredictable behavior in affected systems using the tegra210-quad SPI driver.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The description indicates a fix has been implemented in the Linux kernel source code, but no explicit patch link or vendor advisory is provided. Users should monitor official Linux kernel updates and apply relevant patches when available.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-ghj7-pch2-m5m6
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2025-68746"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a6b72d29c2644c7f8477681
Added to database: 07/30/2026, 15:50:42 UTC
Last enriched: 07/30/2026, 19:07:12 UTC
Last updated: 09/10/2026, 19:38:47 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.