CVE-2026-80752 in Linux
Summary
by MITRE • 09/03/2026
In the Linux kernel, the following vulnerability has been resolved:
Input: psxpad-spi - set driver data before use
psxpad_spi_suspend() retrieves the controller state with spi_get_drvdata(), but probe never stores it, so suspend dereferences a NULL pointer. Store it during probe.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/03/2026
The identified vulnerability resides within the Linux kernel's input subsystem, specifically affecting the psxpad-spi driver which manages Sony PlayStation controllers connected via SPI interfaces. This issue manifests as a null pointer dereference that occurs when the system attempts to suspend or resume the device. The root cause is an improper initialization sequence during the driver probe phase. In standard Linux kernel driver architecture, the probe function is responsible for initializing hardware and allocating necessary resources before they are accessed by other lifecycle functions such as suspend or resume. However, in this specific implementation, the controller state structure was not stored into the device's driver data field using spi_set_drvdata() during the probe routine. Consequently, when the system enters a suspended state, the psxpad_spi_suspend function attempts to retrieve this critical context information by calling spi_get_drvdata(). Since no data was ever saved at that location, the retrieval operation returns NULL instead of a valid pointer to the controller's operational state.
This null pointer is then immediately dereferenced in subsequent operations within the suspend handler without adequate validation checks for validity. Dereferencing a NULL pointer triggers a kernel panic or an oops condition, leading to immediate system instability and potential crash depending on the context in which it occurs. This represents a classic case of improper resource initialization where dependent functions assume that prerequisite setup steps have been completed successfully. The vulnerability is classified under CWE-476, which denotes a NULL Pointer Dereference, indicating that the software performs an operation using a pointer to memory that has not been properly initialized or allocated. From a defensive perspective, this flaw highlights the critical importance of adhering strictly to driver lifecycle protocols where all necessary data structures must be bound to device objects before any other function might access them.
From an operational impact standpoint, while local physical access is typically required to trigger suspend events through user interaction with peripherals, the vulnerability can potentially be exploited by a malicious actor who has already gained limited execution privileges on the system. By repeatedly triggering suspend and resume cycles involving this specific SPI device, an attacker could induce denial of service conditions against the entire host machine. This aligns with MITRE ATT&CK technique T1499, Endpoint Denial of Service, where resource exhaustion or instability is used to disrupt availability. Although it does not directly allow for privilege escalation in its current form due to the nature of kernel panics often requiring additional exploitation steps like heap spraying or specific memory layouts to gain code execution, it significantly degrades system reliability and integrity.
Mitigation strategies primarily involve applying vendor-provided patches that correct the initialization order within the driver's probe function. The fix requires ensuring that spi_set_drvdata() is called immediately after allocating and initializing the controller state structure so that subsequent calls to spi_get_drvdata() in suspend or resume handlers return valid memory addresses. System administrators should ensure their kernels are updated with these upstream fixes as soon as they become available through official distribution channels. Additionally, developers reviewing similar SPI drivers should audit probe functions for completeness of data binding operations and implement defensive coding practices such as null checks before dereferencing pointers retrieved from device contexts to prevent regressions in future code changes.