HIGH
hsi DmaMask Deref
CVE-2026-89594
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI5.5MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device The OMAP SSI driver uses a synthetic HSI controller device allocated via hsi_alloc_controller(), which does not go through the normal OF/platform device initialization path. As a result, the embedded struct device does not have a DMA mask initialized by default. After recent DMA API hardening changes, dma_map_sg() and related helpers now require a valid dma_mask to be present, otherwise the driver may crash or trigger warnings when attempting DMA mapping operations. Fix this by explicitly initializing the DMA mask for the SSI controller device and setting a 32-bit DMA mask, which matches the hardware capabilities.
02KernelScan AI Analysis
Risk summary
Systems with OMAP SSI controller hardware experience a kernel crash when the SSI driver probes, because the driver's synthetic device lacks an initialized DMA mask. The crash occurs at boot or driver load time and affects only devices with this specific hardware, such as certain OMAP-based embedded platforms.
Vulnerability analysis
The OMAP SSI driver allocates a synthetic controller device that bypasses the normal platform device initialization path, leaving its DMA mask pointer unset. When the driver performs DMA mapping operations, the kernel dereferences the NULL DMA mask pointer and crashes. The fix explicitly initializes the DMA mask to a 32-bit value matching the hardware before any DMA operations are attempted. This issue is only reachable on systems with OMAP SSI controller hardware present and the corresponding driver loaded; it triggers automatically during driver probe without any attacker-controlled input.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | — | 5.10.270 | a4beb841f84e |
| 5.15 | — | 5.15.221 | 9ecef057b7a7 |
| 5.9 | 5.9.2 | 5.10 | 6a5426f56de9 |
| 6.1 | — | 6.1.188 | 9963a65be2be |
| 6.12 | — | 6.12.109 | 4e019e5e247b |
| 6.18 | — | 6.18.50 | fbffbfdae559 |
| 6.6 | — | 6.6.157 | e8d47e309c70 |
| 7.2 | — | 7.2.4 | e81250ec6b69 |
| mainline | — | 7.3 | — |
| cip/5.10 | — | 5.10.271-cip78 | 6a5426f56de9 |
| cip/6.1 | — | 6.1.189-cip61 | 9ecef057b7a7 |
| cip/6.1-rt | — | 6.1.189-cip61-rt32 | 9ecef057b7a7 |
| cip/6.12 | — | 6.12.111-cip32 | e8d47e309c70 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |