{"cve":"CVE-2026-46192","nvd":{"published":"2026-05-28T10:16:34.837","modified":"2026-06-17T10:53:15.030","status":"Analyzed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: microchip-core-qspi: don't attempt to transmit during emulated read-only dual/quad operations\n\nThe core will deal with reads by creating clock cycles itself, there's\nno need to generate clock cycles by transmitting garbage data at the\ndriver level. Further, transmitting garbage data just bricks the transfer\nsince QSPI doesn't have a dedicated master-out line like MOSI in regular\nSPI. I'm not entirely sure if the transfer is bricked because of the\ngarbage data being transmitted on the bus or because the core loses\ntrack of whether it is supposed to be sending or receiving data.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5},"cwes":[],"references":["https://git.kernel.org/stable/c/67184f361ab4d9fac6d2b8d5fed6649d496038a4","https://git.kernel.org/stable/c/eb56deaabf127e8985fc91fa6c97bf8a3b062844","https://git.kernel.org/stable/c/ec9d0ddbde6003c303fa5e1d5cd48952852984d8"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T22:36:28.938604137+00:00"},"epss":{"cve":"CVE-2026-46192","score":0.00121,"percentile":0.01867,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}