CVE-2026-31389: spi: fix use-after-free on controller registration failure
In the Linux kernel, the following vulnerability has been resolved:
spi: fix use-after-free on controller registration failure
Make sure to deregister from driver core also in the unlikely event that per-cpu statistics allocation fails during controller registration to avoid use-after-free (of driver resources) and unclocked register accesses.
Affected Software
Event History
Frequently Asked Questions
When can this flaw be triggered?
It is triggered when SPI controller registration fails because allocation of per-CPU statistics fails. The affected cleanup path can then leave driver-core registration in place while driver resources have been freed.
What access does an attacker need?
The supplied vector indicates local access, low attack complexity, and low privileges are required. No user interaction is required.
What is the potential impact?
The flaw can cause use-after-free of driver resources and accesses to registers while they are unclocked. The supplied severity vector indicates potential high impact to confidentiality, integrity, and availability.
What is the remediation?
Apply a Linux kernel update containing the SPI controller registration cleanup fix. The referenced stable kernel commits provide the available fix sources.