The Linux kernel's microchip-core-qspi SPI controller has a vulnerability where the built-in chip select (CS), which is automatically controlled by hardware for a single device, can be incorrectly asserted low when Linux attempts to access a device using GPIO-controlled chip selects. This causes the built-in CS to interfere with GPIO CS devices, potentially leading to hardware communication issues. The problem was undetected because boards with multiple SPI devices used only GPIO CS lines, avoiding reliance on the built-in CS. The issue is fixed in Linux kernel versions 7.0.0-28.28 and later variants as listed. The vulnerability has a CVSS 3.1 score of 5.5, indicating a medium severity impact with local attacker privileges and no user interaction required. The vendor advisory from Ubuntu confirms the availability of patches and recommends updating to fixed kernel versions.

The vulnerability can cause the built-in chip select signal to be asserted incorrectly when multiple SPI devices are attached, potentially disrupting communication with SPI devices that use GPIO chip selects. This may lead to denial of service or hardware malfunction on affected systems. The CVSS vector indicates no confidentiality or integrity impact but a high availability impact. No known exploits are reported in the wild.

A patch is available and should be applied by updating the Linux kernel to versions 7.0.0-28.28 or later as specified in the Ubuntu security advisories USN-8566-1 and USN-8568-1. After updating, a system reboot is required. Due to an ABI change, third-party kernel modules must be recompiled and reinstalled. No additional mitigation is necessary once the update is applied.